Cascade producing wrong resutls when auth prevents children

arijit · September 17, 2020, 1:48am

This issue is fixed in master.

github.com/dgraph-io/dgraph

fix(GraphQL): Fix cascade with auth query when RBAC is false

dgraph-io:master ← dgraph-io:arijitAD/fix-cascade-auth

opened 11:56AM - 14 Sep 20 UTC

arijitAD

+151 -5

Fixes GRAPHQL-656 Query: ``` query { queryContact @cascade { … id nickName adminTasks { id name occurrences { due comp } } } } ``` If `adminTasks` has RBAC rules which are evaluated to `false` the query will be rewritten as follows. ``` query { queryContact(func: uid(ContactRoot)) @cascade { id : uid } ContactRoot as var(func: uid(Contact2)) Contact2 as var(func: type(Contact)) } ``` This has better performance but returns `Contact` for queries with @cascade even if they don't have children fields. After this PR the query is rewritten as follows: ``` query { queryContact(func: uid(ContactRoot)) @cascade { id : uid nickName : Contact.nickName adminTasks : Contact.adminTasks @filter(uid(AdminTask6)) { id : uid name : AdminTask.name occurrences : AdminTask.occurrences @filter(uid(TaskOccurrence4)) { due : TaskOccurrence.due comp : TaskOccurrence.comp dgraph.uid : uid } } } ContactRoot as var(func: uid(Contact7)) Contact7 as var(func: type(Contact)) var(func: uid(ContactRoot)) { AdminTask1 as Contact.adminTasks } AdminTask6 as var(func: uid(AdminTask1)) @filter(uid(AdminTask5)) var(func: uid(AdminTask1)) { TaskOccurrence2 as AdminTask.occurrences } TaskOccurrence4 as var(func: uid(TaskOccurrence2)) @filter(uid(TaskOccurrenceAuth3)) TaskOccurrenceAuth3 as var(func: uid(TaskOccurrence2)) @filter(eq(TaskOccurrence.role, "ADMINISTRATOR")) @cascade AdminTask5 as var(func: uid()) } ``` --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/dgraph-io/dgraph/6444) Docs Preview: [<img src="https://bl.ocks.org/prashant-shahi/raw/3a9f99bec84231cfe3c0e82cf883f159/0e588d908ad8c8b10958b87ebdd2ba68779ccf4f/dgraph.svg" height="34" align="absmiddle" alt="Dgraph Preview"/>](https://dgraph-3800fdad4e-93905.surge.sh)

Topic		Replies	Views
Unexpected behavior with @auth rules when using fragments and @cascade GraphQL dgraph , status:accepted , kind:bug , ticket:created	11	938	February 23, 2021
Scope of Auth Directive Query Rules GraphQL auth	16	1757	August 21, 2020
Can not apply filters for related entities GraphQL	3	365	March 12, 2021
Putting it All Together - Dgraph Authentication, Authorization, and Granular Access Control (PART 2) - Dgraph Blog Blog	12	1618	January 15, 2022
The `@auth` directive - Graphql Documentation	13	2543	December 12, 2020

Cascade producing wrong resutls when auth prevents children

Related topics