hasura / hasura/graphql-engine

Inherited Role Permission Inconsistency

Open
#9,202 8 comments 0 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: 2.14.0

### Environment

OSS

### What is the current behaviour?

I have a few set of roles setup for inheritence:

* `maker` inherits `user`
* `staff` inherits `content_manager` and `maker`

If I provide update or delete permissions on a the same table to both `user` and `content_manager` but with different check clauses, I end up with this error state:

```
[
{
"definition": null,
"reason": "Could not inherit permission for the role 'staff' for the entity: 'update permission, table: ...",
"type": "inherited role permission inconsistency"
}
]
```

I tried setting the permission on `maker` instead of `user` and the same error happens.

### What is the expected behaviour?

I would expect staff to gain the permissions from the `content_manager` role as that appears first in the list of inherited roles.

### Any possible solutions/workarounds you're aware of?

The only work around I've found so far is to duplicate the permissions directly on the `staff` role. This breaks basic DRY principles and introduces an extra maintenance load.

### Keywords
inherited roles, metadata inconsistency

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the stated role hierarchy: staff inherits content_manager and maker, while maker inherits user, with conflicting update or delete checks on the same table. Done means inherited permissions resolve without an inconsistency error and follow the expected precedence, without duplicating permissions on staff.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.