Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recursion limit #341

Open
scheibling opened this issue Dec 2, 2024 · 0 comments
Open

Recursion limit #341

scheibling opened this issue Dec 2, 2024 · 0 comments

Comments

@scheibling
Copy link

Describe the bug
Is there (supposed to be) a limit on the levels of recursion when listing relationship based permissions?

I wasn't able to find anything in the documentation about this, one level down (e.g. tenant > partner) listing relationships works, but two or multiple levels down (e.g. tenant > partner > customer) rarely works at all

To Reproduce

{
        "type": "user",
        "relations": {}
 },
 {
     "type": "tenant",
     "relations": {
         "admin": {},
     }
 },
 {
     "type": "partner",
     "relations": {
         "parent": {},
         "member": {
             "inheritIf": "admin",
             "withRelation": "parent",
             "ofType": "tenant"
         }
     }
 },
 {
     "type": "account",
     "relations": {
         "owner": {},
         "member": {
             "inheritIf": "member",
             "withRelation": "owner",
             "ofType": "partner"
         }
     }
 }

Objects:

Type Name Relations
User stephen admin->tenant:test
Tenant test -
Partner testpart parent->tenant:test
Account customer1 owner->partner:testpart

Expected result: stephen gets the member role on the partner object testpart
Actual result (check user:stephen member partner:testpart): True
Actual result (select partner where user:stephen is member): partner:testpart

But when adding another level of relationships, the list results start showing up empty:

Expected result: stephen has the member role on the account object customer1
Actual result (check user:stephen member account:customer1): True
Actual result (select account where user:stephen is member): empty

So the checks still report the correct result, but they're not showing in the listing

Expected behavior
With the explicit flag is not set, one would assume the account should show up in the last select account-query, haven't been able to find anything in the documentation on a limit of X levels of checks so far

Additional context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant