Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Re-creating a resource by name changes its owner and drops the roles granted on it

Aberta
  • Algo errado?
#2,002 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
42/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
go, postgresql
Domínio
authorization, backend

Direção de pesquisa

Start with the conflict update in ResourceRepository.Create in internal/store/postgres/resource_repository.go, which overwrites principal_id and principal_type, then with Create in core/resource/service.go, which deletes all SpiceDB relations before re-adding the parent and owner. Reproduce the steps with CreateProjectResource, CreatePolicy and GetPolicy to confirm the owner and grants are lost. Done means re-creating an existing name keeps the original owner and its granted roles, and the relevant tests pass.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Creating a resource with the name of a live resource in the same project returns the existing row. The URN upsert overwrites principal_id and principal_type, and resource.Service.Create then deletes every SpiceDB relation on the resource before it adds the parent and the new owner.

So the caller becomes the owner, the first owner loses access, and every role granted on the resource stops working, while the policy rows stay. A service that re-creates a resource it already has, on a retry or a re-sync, changes the owner and drops the grants without noticing.

The principal has been overwritten since #261 and the relations deleted since #243. Organization resources (#1987) behave the same way.

Steps

  1. Member X, who can only view the project, creates resource R with CreateProjectResource.
  2. Grant member C a role on R with CreatePolicy.
  3. Member Y creates a resource with the same name and namespace in the same project.
  4. The same id comes back with Y as the principal. X can no longer update R, C's role no longer works, and GetPolicy still returns C's policy.

Code
The conflict update in ResourceRepository.Create (internal/store/postgres/resource_repository.go) writes the principal, and Create in core/resource/service.go deletes all relations on the resource.

Expected
Re-creating a resource keeps its owner and the roles granted on it.

Linguagem predominante
Go
Estrelas
344
Forks
48
Merge médio
2d 9h
PRs com merge (30d)
48

Preparar o ambiente

  • Inclui um Dockerfile ou arquivo Docker Compose
  • Tem um modelo de pull request
  • Sem guia de contribuição

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de raystack/frontier

Todas as issues de raystack/frontier

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.