Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[BUG]: RBAC on update with input arrays causes error #9129

Open
rderbier opened this issue Aug 15, 2024 · 1 comment
Open

[BUG]: RBAC on update with input arrays causes error #9129

rderbier opened this issue Aug 15, 2024 · 1 comment
Labels
dgraph Issue or PR created by an internal Dgraph contributor. kind/bug Something is broken.

Comments

@rderbier
Copy link
Contributor

rderbier commented Aug 15, 2024

What version of Dgraph are you using?

v23 or v24.0.1

What is the hardware spec (RAM, CPU, OS)?

Cloud

What steps will reproduce the bug?

Deploy schema

type User @auth(
  
      update: { 
        rule: "{ $role: { eq: \"ADMIN\" } }" 
      }
  
){
  email: String! @id
  note: String
}

# Dgraph.Authorization {"VerificationKey":"6ABBAA2014CFF00289D20D20DA296F67","header":"X-Dgraph-AuthToken","namespace":"https://dgraph.io/jwt/claims","Algo":"HS256","ClosedByDefault":true}

from Postman send GraphQL request

mutation MyMutation($input: [AddUserInput!]!, $upsert: Boolean) {
  addUser(input: $input, upsert: $upsert) {
    numUids
    user {
      email
    }
  }
}

with variables

{   "upsert": true,
    "input" : [
        {"email": "a@hypermode.com"},
        {"email": "b@hypermode.com"},
        {"email": "c@hypermode.com"}
    ]
}

and header

X-Dgraph-AuthToken eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJodHRwczovL2RncmFwaC5pby9qd3QvY2xhaW1zIjp7InJvbGUiOiJBRE1JTiJ9fQ.DHYBRLpXfGxntOWTDQObq8_0PrPZfn_xVMAFZqE_zCM

The first invocation is successful ( add)
The second invocation fails with

{
    "errors": [
        {
            "message": "mutation addUser failed because Dgraph execution failed because Some variables are declared multiple times.",
            "locations": [
                {
                    "line": 2,
                    "column": 3
                }
            ],
            "path": [
                "addUser"
            ]
        }
    ],
    "data": {
        "addUser": null
    },
    "extensions": {
        "touched_uids": 6,
        "tracing": {
            "version": 1,
            "startTime": "2024-08-15T19:42:35.509121642Z",
            "endTime": "2024-08-15T19:42:35.513617509Z",
            "duration": 4495877,
            "execution": {
                "resolvers": [
                    {
                        "path": [
                            "addUser"
                        ],
                        "parentType": "Mutation",
                        "fieldName": "addUser",
                        "returnType": "AddUserPayload",
                        "startOffset": 154632,
                        "duration": 4330005,
                        "dgraph": [
                            {
                                "label": "preMutationQuery",
                                "startOffset": 216753,
                                "duration": 3521409
                            },
                            {
                                "label": "mutation",
                                "startOffset": 4068519,
                                "duration": 0
                            },
                            {
                                "label": "query",
                                "startOffset": 0,
                                "duration": 0
                            }
                        ]
                    }
                ]
            }
        }
    }
}
@rderbier rderbier added the kind/bug Something is broken. label Aug 15, 2024
@mwillfox
Copy link

@rderbier thank you so much for looking into this and opening the issue! Just to add my quick input - we are running into this currently in a production system and our workaround for now is to loop over our query and call it multiple times for lists. Obviously, this is not a great workaround for performance and I look forward to resolution! Thanks.

@ryanfoxtyler ryanfoxtyler added the dgraph Issue or PR created by an internal Dgraph contributor. label Aug 28, 2024 — with Linear
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
dgraph Issue or PR created by an internal Dgraph contributor. kind/bug Something is broken.
Development

No branches or pull requests

4 participants