hasura / hasura/graphql-engine
Inherited Role Permission Inconsistency
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: 2.14.0
### Environment
OSS
### What is the current behaviour?
I have a few set of roles setup for inheritence:
* `maker` inherits `user`
* `staff` inherits `content_manager` and `maker`
If I provide update or delete permissions on a the same table to both `user` and `content_manager` but with different check clauses, I end up with this error state:
```
[
{
"definition": null,
"reason": "Could not inherit permission for the role 'staff' for the entity: 'update permission, table: ...",
"type": "inherited role permission inconsistency"
}
]
```
I tried setting the permission on `maker` instead of `user` and the same error happens.
### What is the expected behaviour?
I would expect staff to gain the permissions from the `content_manager` role as that appears first in the list of inherited roles.
### Any possible solutions/workarounds you're aware of?
The only work around I've found so far is to duplicate the permissions directly on the `staff` role. This breaks basic DRY principles and introduces an extra maintenance load.
### Keywords
inherited roles, metadata inconsistency
Contributor guide
Research direction
Start by reproducing the stated role hierarchy: staff inherits content_manager and maker, while maker inherits user, with conflicting update or delete checks on the same table. Done means inherited permissions resolve without an inconsistency error and follow the expected precedence, without duplicating permissions on staff.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100