hasura / hasura/graphql-engine

Select Row Permissions Break Down When Using Multi-Foreign Key Relationships

Open
#9,955 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v2.8.4
CLI Version (for CLI related issue):

### Environment

OSS

### What is the current behaviour?

Permissions break down (console crashes + other unexpected behaviour) when trying to add a filter using an object relationship on more than one column.

### What is the expected behaviour?

Either I shouldn't be able to use the relationship, or if I do, the console shouldn't crash.

### How to reproduce the issue?

1. Create an object relationship from table A to table B using two columns
2. In the select permissions for any role, use a filter on that object relationship
3. That's it, the console will crash

### Screenshots or Screencast

Example offending table:

```yaml
table:
name: property_transactions
schema: public
object_relationships:
- name: buyer_broker <--- MULTI-COLUMN
using:
foreign_key_constraint_on:
- buyer_broker_id
- tenant_id
- name: lot
using:
foreign_key_constraint_on: lot_id
- name: seller_broker <--- SINGLE-COLUMN
using:
foreign_key_constraint_on: seller_broker_id
select_permissions:
- role: agent
permission:
columns:
- ...
filter:
_and:
- tenant_id:
_eq: x-hasura-tenant-id
- _or:
- lot:
broker:
teams_users:
team_id:
_in: x-hasura-teams-ids
- seller_broker: <--- WORKS FINE
teams_users:
team_id:
_in: x-hasura-teams-ids
- buyer_broker: <---- CRASHES
teams_users:
team_id:
_in: x-hasura-teams-ids
```

### Please provide any traces or logs that could help here.

n/a

### Any possible solutions/workarounds you're aware of?

Avoid using multi-column object relationships in your permissions.

In my case, the user_ids are unique accross tenants, so thankfully I was able to fix it by removing tenant_id from the relationship.

### Keywords

n/a

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Use the supplied property_transactions YAML and permission filter as the reproduction case. First reproduce the console crash with a multi-column object relationship, compare it with the working single-column relationship, and trace the permission-filter handling; done means the relationship is rejected safely or the console no longer crashes.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, postgres
Domain
authorization, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.