Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error on PATCH request using update operator expression when permission with mongo.mergeRequest applies #503

Open
ujibang opened this issue Feb 14, 2024 · 0 comments
Assignees
Labels

Comments

@ujibang
Copy link
Contributor

ujibang commented Feb 14, 2024

Describe the bug

PATCH requests allows the body to be an update operator expression or update aggregation pipeline. See https://restheart.org/docs/mongodb-rest/write-docs#mongodb-write-operations

When the request with operator expression is authorized by a permission specifying mongo.mergeRequest, the request fails.

To Reproduce

create test user and permission

$ http -a admin:secret :8080/users _id=test roles:='["test"]' password=secret
$ http -a admin:secret POST :8080/acl _id=testPermission roles:='["test"]' priority:=100 predicate="method(PATCH) and path-prefix('/test')" mongo.mergeRequest:='{ "author": "@user._id" }'

now try a PATCH on /test/doc with update operator expression; the request fails

$ http -a test:secret PUT :8080/test/doc a:=1  # create the doc
$ http -a test:secret PATCH :8080/test/doc "$set":='{"a": 2}'  # ===> this fails
@ujibang ujibang added the bug label Feb 14, 2024
@ujibang ujibang self-assigned this Feb 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant