Fix a bug with virtual records in scoped queries
When querying a virtual document, it would check that the scope had permission to view the record, even though the record did not actually belong to a table. Not it checks to see if the record is a virtual in-memory record, and does not perform any permissions checks if this is the case.
This commit is contained in:
Tobie Morgan Hitchcock
parent
efaccb8afa
commit
47e1a4aceb
4 changed files with 377 additions and 1 deletions
18
db/check.go
18
db/check.go
|
|
@ -52,6 +52,15 @@ func (d *document) grant(ctx context.Context, met method) (ok bool, err error) {
|
||||||
|
|
||||||
var val interface{}
|
var val interface{}
|
||||||
|
|
||||||
|
// If this is a document loaded from
|
||||||
|
// a subquery or data param, and not
|
||||||
|
// from the KV store, then there is
|
||||||
|
// no need to check permissions.
|
||||||
|
|
||||||
|
if d.key == nil {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
// If we are authenticated using DB, NS,
|
// If we are authenticated using DB, NS,
|
||||||
// or KV permissions level, then we can
|
// or KV permissions level, then we can
|
||||||
// ignore all permissions checks, but we
|
// ignore all permissions checks, but we
|
||||||
|
|
@ -123,6 +132,15 @@ func (d *document) allow(ctx context.Context, met method) (ok bool, err error) {
|
||||||
|
|
||||||
var val interface{}
|
var val interface{}
|
||||||
|
|
||||||
|
// If this is a document loaded from
|
||||||
|
// a subquery or data param, and not
|
||||||
|
// from the KV store, then there is
|
||||||
|
// no need to check permissions.
|
||||||
|
|
||||||
|
if d.key == nil {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
// If we are authenticated using DB, NS,
|
// If we are authenticated using DB, NS,
|
||||||
// or KV permissions level, then we can
|
// or KV permissions level, then we can
|
||||||
// ignore all permissions checks, but we
|
// ignore all permissions checks, but we
|
||||||
|
|
|
||||||
|
|
@ -24,6 +24,15 @@ import (
|
||||||
|
|
||||||
func (d *document) perms(ctx context.Context, doc *data.Doc) (err error) {
|
func (d *document) perms(ctx context.Context, doc *data.Doc) (err error) {
|
||||||
|
|
||||||
|
// If this is a document loaded from
|
||||||
|
// a subquery or data param, and not
|
||||||
|
// from the KV store, then there is
|
||||||
|
// no need to check permissions.
|
||||||
|
|
||||||
|
if d.key == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
// Get the field definitions so we can
|
// Get the field definitions so we can
|
||||||
// check if the permissions allow us
|
// check if the permissions allow us
|
||||||
// to view each field.
|
// to view each field.
|
||||||
|
|
|
||||||
250
db/scope_test.go
Normal file
250
db/scope_test.go
Normal file
|
|
@ -0,0 +1,250 @@
|
||||||
|
// Copyright © 2016 Abcum Ltd
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
package db
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/abcum/surreal/sql"
|
||||||
|
"github.com/abcum/surreal/util/data"
|
||||||
|
. "github.com/smartystreets/goconvey/convey"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestScope(t *testing.T) {
|
||||||
|
|
||||||
|
Convey("Select records from an array of strings", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
DEFINE NAMESPACE test;
|
||||||
|
DEFINE DATABASE test;
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 3)
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM [
|
||||||
|
"one",
|
||||||
|
"two",
|
||||||
|
"tre",
|
||||||
|
];
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupSC(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, "one")
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, "two")
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, "tre")
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of objects with an id key", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
DEFINE NAMESPACE test;
|
||||||
|
DEFINE DATABASE test;
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 3)
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM [
|
||||||
|
{ id: "one" },
|
||||||
|
{ id: "two" },
|
||||||
|
{ id: "tre" },
|
||||||
|
];
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupSC(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, map[string]interface{}{"id": "one"})
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, map[string]interface{}{"id": "two"})
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, map[string]interface{}{"id": "tre"})
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of objects with no id key", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
DEFINE NAMESPACE test;
|
||||||
|
DEFINE DATABASE test;
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 3)
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM [
|
||||||
|
{ test: "one" },
|
||||||
|
{ test: "two" },
|
||||||
|
{ test: "tre" },
|
||||||
|
];
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupSC(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, map[string]interface{}{"test": "one"})
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, map[string]interface{}{"test": "two"})
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, map[string]interface{}{"test": "tre"})
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of virtual record things with no permissions", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
DEFINE NAMESPACE test;
|
||||||
|
DEFINE DATABASE test;
|
||||||
|
CREATE test:one, test:two, test:tre;
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 4)
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM array(
|
||||||
|
thing("test", "one"),
|
||||||
|
thing("test", "two"),
|
||||||
|
thing("test", "tre")
|
||||||
|
);
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupSC(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 0)
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of virtual record things with full permissions", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
DEFINE NAMESPACE test;
|
||||||
|
DEFINE DATABASE test;
|
||||||
|
DEFINE TABLE test PERMISSIONS FULL;
|
||||||
|
CREATE test:one, test:two, test:tre;
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 5)
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
func() {
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM array(
|
||||||
|
thing("test", "one"),
|
||||||
|
thing("test", "two"),
|
||||||
|
thing("test", "tre")
|
||||||
|
);
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupSC(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, map[string]interface{}{
|
||||||
|
"id": sql.NewThing("test", "one"),
|
||||||
|
"meta": map[string]interface{}{
|
||||||
|
"tb": "test",
|
||||||
|
"id": "one",
|
||||||
|
},
|
||||||
|
})
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, map[string]interface{}{
|
||||||
|
"id": sql.NewThing("test", "two"),
|
||||||
|
"meta": map[string]interface{}{
|
||||||
|
"tb": "test",
|
||||||
|
"id": "two",
|
||||||
|
},
|
||||||
|
})
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, map[string]interface{}{
|
||||||
|
"id": sql.NewThing("test", "tre"),
|
||||||
|
"meta": map[string]interface{}{
|
||||||
|
"tb": "test",
|
||||||
|
"id": "tre",
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
}()
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -92,7 +92,7 @@ func TestSelect(t *testing.T) {
|
||||||
|
|
||||||
})
|
})
|
||||||
|
|
||||||
Convey("Select records from multiple things", t, func() {
|
Convey("Select records from multiple tables", t, func() {
|
||||||
|
|
||||||
setupDB()
|
setupDB()
|
||||||
|
|
||||||
|
|
@ -136,6 +136,105 @@ func TestSelect(t *testing.T) {
|
||||||
|
|
||||||
})
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of strings", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM ["one", "two", "tre"];
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, "one")
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, "two")
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, "tre")
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of objects with an id key", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM [{ id: "one" }, { id: "two" }, { id: "tre" }];
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, map[string]interface{}{"id": "one"})
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, map[string]interface{}{"id": "two"})
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, map[string]interface{}{"id": "tre"})
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of objects with no id key", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
SELECT * FROM [{ test: "one" }, { test: "two" }, { test: "tre" }];
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 2)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, map[string]interface{}{"test": "one"})
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, map[string]interface{}{"test": "two"})
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, map[string]interface{}{"test": "tre"})
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("Select records from an array of virtual record things", t, func() {
|
||||||
|
|
||||||
|
setupDB()
|
||||||
|
|
||||||
|
txt := `
|
||||||
|
USE NS test DB test;
|
||||||
|
CREATE test:one, test:two, test:tre;
|
||||||
|
SELECT * FROM array(
|
||||||
|
thing("test", "one"),
|
||||||
|
thing("test", "two"),
|
||||||
|
thing("test", "tre")
|
||||||
|
);
|
||||||
|
`
|
||||||
|
|
||||||
|
res, err := Execute(setupKV(), txt, nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
So(res, ShouldHaveLength, 3)
|
||||||
|
So(res[1].Result, ShouldHaveLength, 3)
|
||||||
|
So(data.Consume(res[1].Result[0]).Data(), ShouldResemble, map[string]interface{}{
|
||||||
|
"id": sql.NewThing("test", "one"),
|
||||||
|
"meta": map[string]interface{}{
|
||||||
|
"tb": "test",
|
||||||
|
"id": "one",
|
||||||
|
},
|
||||||
|
})
|
||||||
|
So(data.Consume(res[1].Result[1]).Data(), ShouldResemble, map[string]interface{}{
|
||||||
|
"id": sql.NewThing("test", "two"),
|
||||||
|
"meta": map[string]interface{}{
|
||||||
|
"tb": "test",
|
||||||
|
"id": "two",
|
||||||
|
},
|
||||||
|
})
|
||||||
|
So(data.Consume(res[1].Result[2]).Data(), ShouldResemble, map[string]interface{}{
|
||||||
|
"id": sql.NewThing("test", "tre"),
|
||||||
|
"meta": map[string]interface{}{
|
||||||
|
"tb": "test",
|
||||||
|
"id": "tre",
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
})
|
||||||
|
|
||||||
Convey("Select records with an embedded record field", t, func() {
|
Convey("Select records with an embedded record field", t, func() {
|
||||||
|
|
||||||
setupDB()
|
setupDB()
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue