Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bug: accessing wires that specify a context override (e.g., workspace context) fail to load unless underlying profile has at least read level permission #4554

Open
techfg opened this issue Feb 4, 2025 · 0 comments

Comments

@techfg
Copy link
Collaborator

techfg commented Feb 4, 2025

Currently, there are features leveraged within Studio that load wires in a "workspace" context vs the "standard" context. For example, bulkjobs is loaded in workspace context in the onload event.

The issue is that if the user doesn't have at least read level permissions to the wire, when a view is loaded, the metadata for the wire is attempted to be retrieved in load and it will fail. However, in the workspace context, it would otherwise succeed.

The current solution to this is to grant read permissions to any collections that will/would be used in a workspace context however this is not ideal and presents a security risk.

In order to resolve, there are a couple options:

  1. Move the concept of "context" into the wire definition itself (e.g., add a context property to wire definition in yaml) and perform load operations in the corresponding context. If its never expected/allowed that a single wire in a view could ever operate in multiple contexts, then this is likely the best path forward.
  2. Defer the metadata retrieval until the wire itself is actually loaded. This actually makes a lot of sense (don't use it until you need it) but there are other portions of the system that rely on metadata being present (e.g., components that rely on wire definitions possibly one of those?). As a quick test, deferring the load of the metadata (by trying to skip metadata load when op.query = false) still failed the page because of some other failure (didn't investigate fully the reason why). In theory, not accessing the wire at all until its needed and doing so in the proper context makes sense if there aren't other core parts of the system that will need the metadata.

In short, an approach and decision needs to be made on how to handle this use case which is "special" to studio. Once decision made, adjustments would follow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant