hasura / hasura/graphql-engine

Inherited roles should default to check-less roles when available

Open
#8,334 0 comments 0 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: 2.2.2

### Environment

OSS

### What is the expected behaviour?

When an inherited role inherits two similar roles on a same table, but one of them has a custom check and the other one doesn't, I expect the check-less role to "win".

### What is the current behaviour?

If an inherited role has two similar roles on a same table, one with a custom check and the other one without, the custom check role wins. The condition must be met even though the other role doesn't require it.

### How to reproduce the issue?

1. Track a given table that has a "user_id" column (for example)
2. Add a select permission with `role_no_check`
3. choose "without any checks"
4. Add a select permission with `role_with_check`
5. Select "with custom check" and enter `{"user_id":{"_eq":"X-Hasura-User-Id"}}`
6. Create an inherited role `test` that has both `role_no_check` and `role_with_check`
7. Go to the API panel
8. query given table with `x-hasura-role: test`
9. failure: `"missing session variable: \"x-hasura-user-id\""`

### Much worse....
if you add a proper `x-hasura-user-id`, you still get **all** results!

### If the bug is confirmed, would you be willing to submit a PR?

No.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.