Comments (4)
This seems like a prisma issue then. What are your thoughts on zenstack optimising queries? Is it out of scope?
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[{"OR":[]},{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}} {"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[false,{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}} {"where":{"OR":[{"OR":[{"gym":{"members":{"some":false}}}]}]}} {"where":{"OR":[{"OR":[false]}]}} {"where":false} return [] or throw;
Yes, I agree reduction is the way to go. And it's more than an optimization, but rather for correctness ... Will add it soon.
from zenstack.
Although the reference doc mentions a check to require login, it's not obvious how big of an issue not having it is.
// require login
@@deny('all', auth() == null)
From my mental model, this policy is used to check the role of the current user. So that check should never pass if the user is undefined, as user == auth()
will never match because user is not an optional field.
// space admin can update and delete
@@allow('update,delete', members?[user == auth() && role == 'ADMIN'])
But the policy seems to behave in a fail-open
mode, which is not what we expect from a security perspective.
For now, the fix is to add @@deny('all', auth() == null)
to the Base model. But this is a pretty big foot gun for teams who might not know about this.
from zenstack.
Thanks for reporting and commenting @Adhil523 @sidharthv96 .
I still need to confirm, but I tend to believe this is related to this Prisma issue I reported quite a while ago:
The background is that ZenStack internally uses an empty OR (OR: []
) to represent a false
condition, and Prisma doesn't behave consistently in different combinations.
from zenstack.
This seems like a prisma issue then. What are your thoughts on zenstack optimising queries? Is it out of scope?
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[{"OR":[]},{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}}
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":{"AND":[false,{"OR":[{"role":{"equals":"ADMIN"}},{"role":{"equals":"TRAINER"}}]}]}}}}]}]}}
{"where":{"OR":[{"OR":[{"gym":{"members":{"some":false}}}]}]}}
{"where":{"OR":[{"OR":[false]}]}}
{"where":false}
return [] or throw;
from zenstack.
Related Issues (20)
- [Question] Does the @zenstackhq/trpc plugin support optimistic updates? HOT 1
- @zenstackhq/trpc breaks with TypeScript error. HOT 2
- CompileError: WebAssembly.Module() HOT 1
- Next.js: Module not found: Can't resolve '.zenstack/enhance' HOT 1
- Zenstack VSCode plugin import from a NPM package leads to `Cannot find model file` error HOT 1
- Zenstack deleted all my code projects
- [Feature Request] Allow overridding of model properties when importing
- [Bug] Access Policy: check() function is being ignored if future() is being used
- [Feature Request] Add a `@encrypted` enhancer
- Field-level `read` policy should filter out the unmet data returned from findMany if the field is used in the filter
- [Bug] Delegate model not returning extend model fields in nested include
- [Feature Request] ZenStack CLI syntax checking for ZModel
- [Bug] Delegate Model and Extended Model should support different db schema HOT 1
- [Bug] future() problems on one-to-one relations
- RESTful API RESULT_NOT_READABLE status HOT 1
- [Feature Request] add prisma output to APIHandlerBase handleRequest return value
- [Feature Request] Allow skipping some plugins when running `zenstack generate`
- Field-level deny access policy cause runtime error
- [Feature Request] Extensibility for Custom Validation Attributes in Zmodel.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from zenstack.