hasura / hasura/graphql-engine
Inherited roles should default to check-less roles when available
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: 2.2.2
### Environment
OSS
### What is the expected behaviour?
When an inherited role inherits two similar roles on a same table, but one of them has a custom check and the other one doesn't, I expect the check-less role to "win".
### What is the current behaviour?
If an inherited role has two similar roles on a same table, one with a custom check and the other one without, the custom check role wins. The condition must be met even though the other role doesn't require it.
### How to reproduce the issue?
1. Track a given table that has a "user_id" column (for example)
2. Add a select permission with `role_no_check`
3. choose "without any checks"
4. Add a select permission with `role_with_check`
5. Select "with custom check" and enter `{"user_id":{"_eq":"X-Hasura-User-Id"}}`
6. Create an inherited role `test` that has both `role_no_check` and `role_with_check`
7. Go to the API panel
8. query given table with `x-hasura-role: test`
9. failure: `"missing session variable: \"x-hasura-user-id\""`
### Much worse....
if you add a proper `x-hasura-user-id`, you still get **all** results!
### If the bug is confirmed, would you be willing to submit a PR?
No.
Contributor guide
Assessment
This issue has not been assessed yet.