Repository navigation
feat(security): route query reads through Reader and repair cross-tenant memberships - #113
Merged
Merged
Conversation
Query code used to reach the raw engine view in 69 places, each relying on the convention that it only receives ids already known to be in the reader's tenant. - Reader gains the tenant-checked lookups query paths need: incidence, contains, incidentEdges, hyperedge, isEdge, incidentTree and incidentCursor. Each checks the tenant inside the lookup it already makes, so they cost nothing extra. MATCH, RANK, PATTERN, HORA and temporal queries now use only Reader. - The raw view is renamed engineView() and stays for engine-wide code: users, tenants, quotas, the schema listing, branch merges and DIFF, view maintenance, and records stamped with their own tenant. TenantBoundaryTest in the database and server modules lists those files with a reason and fails for any other. - hstore check --repair-tenants removes hyperedge memberships that older versions let cross tenants. New, checked and repaired databases record that they are clean; hstore serve warns about the others.
# Conflicts: # database/src/main/java/io/hstore/db/HypergraphDatabase.java # database/src/test/java/io/hstore/db/SecurityTest.java # docs/operations/logging.md
hstore check --repair-tenants only walked main but then recorded the whole database as checked, so crossings on other branches were missed and the startup warning went away.
Statements for other branches needed USE BRANCH, which only global admins may run, and a global admin also needed USE TENANT. Each line now names both. The repair repeats until a fresh scan is clean before it records the database as checked.
# Conflicts: # database/src/main/java/io/hstore/db/HypergraphDatabase.java # database/src/main/java/io/hstore/db/query/Session.java
venkat1701
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #112.
Readeronly; the raw view isengineView(), and a test lists the files allowed to use it.hstore checklists memberships that cross tenants on every active branch, with statements an admin of the default tenant can run as printed.hstore check <dir> --repair-tenantsremoves them and writes to the store;hstore servewarns until a database has been checked.Full build of this branch: engine 257, database 118, server 39, all passing.