Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cherrypick(GraphQL): fix interface query with auth rules #7408

Merged
merged 2 commits into from
Feb 9, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions graphql/e2e/auth/auth_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -492,6 +492,32 @@ func TestAuthOnInterfaces(t *testing.T) {
})
}
}

func TestAuthOnInterfaceWithRBACPositive(t *testing.T) {
getVehicleParams := &common.GraphQLParams{
Query: `
query {
queryVehicle{
owner
}
}`,
Headers: common.GetJWT(t, "Alice", "ADMIN", metaInfo),
}
gqlResponse := getVehicleParams.ExecuteAsPost(t, common.GraphqlURL)
common.RequireNoGQLErrors(t, gqlResponse)

result := `
{
"queryVehicle": [
{
"owner": "Bob"
}
]
}`

require.JSONEq(t, result, string(gqlResponse.Data))
}

func TestAuthRulesWithMissingJWT(t *testing.T) {
testCases := []TestCase{
{name: "Query non auth field without JWT Token",
Expand Down
16 changes: 16 additions & 0 deletions graphql/e2e/auth/schema.graphql
Original file line number Diff line number Diff line change
Expand Up @@ -754,3 +754,19 @@ type Todo {
owner: String
text: String
}

interface Vehicle @auth(
query:{
or:[
{rule: "{$ROLE: { eq: \"ADMIN\" } }"},
{rule: "query($USER: String!) { queryVehicle(filter: { owner: { eq: $USER }}) { owner } }"}
]
}
){
owner: String! @search(by: [exact])
}

type Car implements Vehicle {
id: ID!
manufacturer: String!
}
6 changes: 5 additions & 1 deletion graphql/e2e/auth/test_data.json
Original file line number Diff line number Diff line change
Expand Up @@ -289,5 +289,9 @@
{"uid":"_:Question2","Question.answered":"true"},
{"uid":"_:Question3","Question.answered":"false"},
{"uid":"_:Answer1","Answer.markedUseful":"true"},
{"uid":"_:Answer2","Answer.markedUseful":"true"}
{"uid":"_:Answer2","Answer.markedUseful":"true"},
{"uid":"_:Car1","dgraph.type":"Vehicle"},
{"uid":"_:Car1","dgraph.type":"Car"},
{"uid":"_:Car1","Vehicle.owner":"Bob"},
{"uid":"_:Car1","Car.manufacturer":"Tesla"}
]
23 changes: 23 additions & 0 deletions graphql/resolve/auth_query_test.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1835,3 +1835,26 @@
pwd as checkpwd(Post.pwd, "something")
}
}

-
name: "Query interface should return all the nodes of a type if rbac rules of type are true"
gqlquery: |
query {
queryVehicle{
owner
}
}
jwtvar:
ROLE: "ADMIN"
USER: "user"
dgquery: |-
query {
queryVehicle(func: uid(VehicleRoot)) {
dgraph.type
owner : Vehicle.owner
dgraph.uid : uid
}
VehicleRoot as var(func: uid(Vehicle1)) @filter((uid(Car1)))
Vehicle1 as var(func: type(Vehicle))
Car1 as var(func: type(Car))
}
7 changes: 5 additions & 2 deletions graphql/resolve/query_rewriter.go
Original file line number Diff line number Diff line change
Expand Up @@ -660,11 +660,14 @@ func (authRw *authRewriter) addAuthQueries(
hasAuthRules: authRw.hasAuthRules,
}).rewriteAuthQueries(object)

// If there is no Auth Query for the Given type then it means that
// 1. If there is no Auth Query for the Given type then it means that
// neither the inherited interface, nor this type has any Auth rules.
// In this case the query must return all the nodes of this type.
// then simply we need to Put uid(Todo1) with OR in the main query filter.
if len(objAuthQueries) == 0 {
// 2. If rbac evaluates to `Positive` which means RBAC rule is satisfied.
// Either it is the only auth rule, or it is present with `OR`, which means
// query must return all the nodes of this type.
if len(objAuthQueries) == 0 || rbac == schema.Positive {
objfilter = &gql.FilterTree{
Func: &gql.Function{
Name: "uid",
Expand Down