Skip to content

Fix crud operations permission in update relationships - #300

Merged
abnegate merged 11 commits into
mainfrom
fix-crud-operations-permission-in-update-relationships
Aug 21, 2023
Merged

Fix crud operations permission in update relationships#300
abnegate merged 11 commits into
mainfrom
fix-crud-operations-permission-in-update-relationships

Conversation

@fanatic75

@fanatic75fanatic75 commented Jul 31, 2023•
edited
Loading

Copy link
Copy Markdown
Contributor
  • Skipping authorization for crud operations which are integral parts of logic but not done by the user
  • Added a test case.

@fanatic75
fixes comparison check and permission issues in relationships
89b111c
Skipping authorization for the db calls that are only made for updating document logic but not required by user. Fixes the bug in comparing new document and old document in updateDocument method. Adds a test case to verify.
@github-actionsgithub-actionsBot mentioned this pull request Aug 1, 2023
Closed
stnguyen90
stnguyen90 suggested changes Aug 2, 2023
View reviewed changes
Comment threadsrc/Database/Database.php Outdated
Comment threadsrc/Database/Database.php Outdated
@fanatic75
fanatic75 marked this pull request as draft August 10, 2023 10:59
@fanatic75
Merge branch 'main' ofhttps://github.com/utopia-php/databaseinto fi…
b2b9353
…x-crud-operations-permission-in-update-relationships
stnguyen90
stnguyen90 reviewed Aug 17, 2023
View reviewed changes

@stnguyen90stnguyen90 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this ready for review? Also, it looks like there are merge conflicts.

@fanatic75
Merge branch 'main' ofhttps://github.com/utopia-php/databaseinto fi…
e35025f
…x-crud-operations-permission-in-update-relationships
@abnegate

abnegate commented Aug 18, 2023

Copy link
Copy Markdown
Member

Closing as for now we don't want to allow relating to documents without read permission

@fanatic75fanatic75 reopened this Aug 18, 2023
@fanatic75
fanatic75 marked this pull request as ready for review August 18, 2023 15:52
@fanatic75

fanatic75 commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

@abnegate
I have removed the ability to skip authentication when fetching related documents. However, we still need to perform certain operations, such as updating removed documents from the relation without authentication.

Let's consider this scenario: Level 1 has a one-to-many relationship with Level 2. If we create new documents in Level 2 using Level 1, we should not need update permission in Level 2. However, due to updating old documents, we are unable to create new documents without update permission. This pull request resolves this issue.

abnegate
abnegate reviewed Aug 21, 2023
View reviewed changes
Comment threadsrc/Database/Database.php Outdated
Comment threadtests/Database/Base.php Outdated
@abnegate
abnegate requested review from stnguyen90 and removed request for stnguyen90August 21, 2023 19:10
@abnegate
abnegate merged commit 7f10223 into mainAug 21, 2023
@github-actionsgithub-actionsBot mentioned this pull request Sep 1, 2023
Closed
@abnegate
abnegate deleted the fix-crud-operations-permission-in-update-relationships branch November 23, 2023 01:52
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@abnegateabnegateabnegate approved these changes
+1 more reviewer
@stnguyen90stnguyen90stnguyen90 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@fanatic75@abnegate@stnguyen90