hasura / hasura/graphql-engine
Select Row Permissions Break Down When Using Multi-Foreign Key Relationships
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: v2.8.4
CLI Version (for CLI related issue):
### Environment
OSS
### What is the current behaviour?
Permissions break down (console crashes + other unexpected behaviour) when trying to add a filter using an object relationship on more than one column.
### What is the expected behaviour?
Either I shouldn't be able to use the relationship, or if I do, the console shouldn't crash.
### How to reproduce the issue?
1. Create an object relationship from table A to table B using two columns
2. In the select permissions for any role, use a filter on that object relationship
3. That's it, the console will crash
### Screenshots or Screencast
Example offending table:
```yaml
table:
name: property_transactions
schema: public
object_relationships:
- name: buyer_broker <--- MULTI-COLUMN
using:
foreign_key_constraint_on:
- buyer_broker_id
- tenant_id
- name: lot
using:
foreign_key_constraint_on: lot_id
- name: seller_broker <--- SINGLE-COLUMN
using:
foreign_key_constraint_on: seller_broker_id
select_permissions:
- role: agent
permission:
columns:
- ...
filter:
_and:
- tenant_id:
_eq: x-hasura-tenant-id
- _or:
- lot:
broker:
teams_users:
team_id:
_in: x-hasura-teams-ids
- seller_broker: <--- WORKS FINE
teams_users:
team_id:
_in: x-hasura-teams-ids
- buyer_broker: <---- CRASHES
teams_users:
team_id:
_in: x-hasura-teams-ids
```
### Please provide any traces or logs that could help here.
n/a
### Any possible solutions/workarounds you're aware of?
Avoid using multi-column object relationships in your permissions.
In my case, the user_ids are unique accross tenants, so thankfully I was able to fix it by removing tenant_id from the relationship.
### Keywords
n/a
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Use the supplied property_transactions YAML and permission filter as the reproduction case. First reproduce the console crash with a multi-column object relationship, compare it with the working single-column relationship, and trace the permission-filter handling; done means the relationship is rejected safely or the console no longer crashes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, postgres
- Domain
- authorization, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100