Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(Query) Fix Star_All delete query when used with ACL enabled #6331

Merged
merged 5 commits into from
Aug 31, 2020
Merged

fix(Query) Fix Star_All delete query when used with ACL enabled #6331

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cd0be21
Address Star_All to not be treated as a predicate
all-seeing-code Aug 31, 2020
4998ac9
Remove print statement
all-seeing-code Aug 31, 2020
5ccadf6
Add test cases for ACL
all-seeing-code Aug 31, 2020
092975c
Fix deletion of node in case user has access to dgraph.type
all-seeing-code Aug 31, 2020
a1cf9e3
Remove stale code
all-seeing-code Aug 31, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions edgraph/access_ee.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,7 +588,10 @@ func parsePredsFromMutation(nquads []*api.NQuad) []string {
// use a map to dedup predicates
predsMap := make(map[string]struct{})
for _, nquad := range nquads {
predsMap[nquad.Predicate] = struct{}{}
// _STAR_ALL is not a predicate in itself.
if nquad.Predicate != "_STAR_ALL" {
predsMap[nquad.Predicate] = struct{}{}
}
}

preds := make([]string, 0, len(predsMap))
Expand Down Expand Up @@ -663,7 +666,7 @@ func authorizeMutation(ctx context.Context, gmu *gql.Mutation) error {
return nil
}

blockedPreds, _ := authorizePreds(userId, groupIds, preds, acl.Write)
blockedPreds, allowedPreds := authorizePreds(userId, groupIds, preds, acl.Write)
if len(blockedPreds) > 0 {
var msg strings.Builder
for key := range blockedPreds {
Expand All @@ -673,7 +676,7 @@ func authorizeMutation(ctx context.Context, gmu *gql.Mutation) error {
return status.Errorf(codes.PermissionDenied,
"unauthorized to mutate following predicates: %s\n", msg.String())
}

gmu.AllowedPreds = allowedPreds
return nil
}

Expand Down
7 changes: 4 additions & 3 deletions gql/mutation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,10 @@ var (

// Mutation stores the strings corresponding to set and delete operations.
type Mutation struct {
Cond string
Set []*api.NQuad
Del []*api.NQuad
Cond string
Set []*api.NQuad
Del []*api.NQuad
AllowedPreds []string

Metadata *pb.Metadata
}
Expand Down
8 changes: 5 additions & 3 deletions protos/pb/pb.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

27 changes: 26 additions & 1 deletion query/mutation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,24 @@ func expandEdges(ctx context.Context, m *pb.Mutations) ([]*pb.DirectedEdge, erro
return nil, err
}
preds = append(preds, getPredicatesFromTypes(types)...)
preds = append(preds, x.StarAllPredicates()...)
// AllowedPreds are used only with ACL. Do not delete all predicates but
// delete predicates to which the mutation has access
if edge.AllowedPreds != nil {
// Take intersection of preds and AllowedPreds
intersectPreds := make([]string, 0)
hashMap := make(map[string]bool)
for _, allowedPred := range edge.AllowedPreds {
hashMap[allowedPred] = true
}
for _, pred := range preds {
if _, found := hashMap[pred]; found {
intersectPreds = append(intersectPreds, pred)
}
}
preds = intersectPreds
} else {
preds = append(preds, x.StarAllPredicates()...)
}
}

for _, pred := range preds {
Expand Down Expand Up @@ -186,6 +203,9 @@ func ToDirectedEdges(gmuList []*gql.Mutation, newUids map[string]uint64) (
if err != nil {
return errors.Wrap(err, "")
}
// if nq.AllowedPreds != nil {
// edge.AllowedPreds = nq.AllowedPreds
// }
edge.Op = op
edges = append(edges, edge)
return nil
Expand All @@ -200,6 +220,11 @@ func ToDirectedEdges(gmuList []*gql.Mutation, newUids map[string]uint64) (
if err := parse(nq, pb.DirectedEdge_DEL); err != nil {
return edges, err
}
if gmu.AllowedPreds != nil {
for _, e := range edges {
e.AllowedPreds = gmu.AllowedPreds
}
}
}
for _, nq := range gmu.Set {
if err := facets.SortAndValidate(nq.Facets); err != nil {
Expand Down