Unauthenticated users can read from tables about zenstack HOT 4 CLOSED

This seems like a prisma issue then. What are your thoughts on zenstack optimising queries? Is it out of scope?

{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[{"OR":[]},{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}}
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[false,{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}}
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":false}}}]}]}}
{"where":{"OR":[{"OR":[false]}]}}
{"where":false}
return [] or throw;

Yes, I agree reduction is the way to go. And it's more than an optimization, but rather for correctness ... Will add it soon.

from zenstack.

Although the reference doc mentions a check to require login, it's not obvious how big of an issue not having it is.

    // require login
    @@deny('all', auth() == null)

From my mental model, this policy is used to check the role of the current user. So that check should never pass if the user is undefined, as user == auth() will never match because user is not an optional field.

  // space admin can update and delete
  @@allow('update,delete', members?[user == auth() && role == 'ADMIN'])

But the policy seems to behave in a fail-open mode, which is not what we expect from a security perspective.

For now, the fix is to add @@deny('all', auth() == null) to the Base model. But this is a pretty big foot gun for teams who might not know about this.

from zenstack.

Thanks for reporting and commenting @Adhil523 @sidharthv96 .

I still need to confirm, but I tend to believe this is related to this Prisma issue I reported quite a while ago:

prisma/prisma#21856

The background is that ZenStack internally uses an empty OR (OR: []) to represent a false condition, and Prisma doesn't behave consistently in different combinations.

from zenstack.

This seems like a prisma issue then. What are your thoughts on zenstack optimising queries? Is it out of scope?

{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[{"OR":[]},{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}}
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[false,{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}}
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":false}}}]}]}}
{"where":{"OR":[{"OR":[false]}]}}
{"where":false}
return [] or throw;

from zenstack.