Access Control: the Subject picker on the Administrators tab finds no user on an instance with three users, while the grant by email works

已关闭
  • 哪里不对？
#7,908 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
47/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
csharp, postgresql
领域
authentication, authorization

调研方向

Start with AccessControlLayoutArea in src/MeshWeaver.Graph and the canonical queries in src/MeshWeaver.Mesh.Contract/Security/AccessSubjectQueries; compare the users query and picker results with the successful email grant path. Check the Postgres planner and auth lookup mirror behavior described in #3206, then reproduce whether the users query returns no rows or fails. Done when the picker lists provisioned users on the Administrators tab and the relevant behavior is covered by a test.

由索引模型根据 Issue 内容生成。

描述

area:security bug sev:L

Why this repository, and prior art

The Subject picker of the Access Control form is AccessControlLayoutArea (src/MeshWeaver.Graph) with the canonical queries of AccessSubjectQueries (src/MeshWeaver.Mesh.Contract/Security), both in this repository; the Administrators tab of the instance app renders that form for the Admin node. Prior art checked: #213 and #217 (the picker could not select a user; canonical queries and in-memory filtering, 2026-07/08), #338 (grant by email), #3202 and #3206 (unanchored queries refused by the Postgres planner; nodeType:User namespace:"" is the users query). None describes a picker that returns no user at all while the grant by email succeeds.

What happened

On a customer estate's working instance (enterprise plan, build 3.1.12572, commit 3f32f7c1, PostgreSQL storage, Orleans clustering, two replicas; invitation-only, Microsoft sign-in only), the platform administrator opened the Administrators tab (/Admin/Settings/GlobalAdmin) on 2026-11-05 between 15:30 and 15:45 CET to appoint a second administrator.

  1. The picker "Add user or group" answered "no items found", both for the person onboarded minutes earlier and for a person onboarded the day before (2026-11-04), whose invitation shows Accepted. The administrator's own account was not tested.
  2. The email field of the same Add row worked at once: typing the new person's address gave "… already has an account — granted Admin here." The Administrators tab then listed both administrators, and the Admin app opened for the new one.
  3. /health of the same replica at 15:34 CET: user_directory: Healthy — user directory hydrated: 3 user(s) indexed by email.

What I did not establish

  1. Whether the users query (nodeType:User namespace:"", routed to the auth lookup mirror) returned zero rows, was refused as insufficiently anchored on the Postgres planner (#3206's rule), or failed before the picker loaded its set; the instance log was not read.
  2. Whether the page had been opened before the newer account existed (the picker loads its subject set once); the older account rules that out as the only cause.
  3. Whether the same picker finds users on other pages of the same instance (a Space's Access Control), and whether the groups half of the query answered.

Expected

The picker lists every provisioned user, as #217 established; the email route is the fallback for not-yet-provisioned people (#338), not for existing accounts.

Severity

sev:L, proposed: the administrator grant could be given through the email route, so nothing was blocked; the picker's answer is misleading on an instance that is being handed over.

主要语言
C#
星标
12
派生
5
平均合并
5 小时 14 分钟
30 天内合并 PR
937

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Systemorph/MeshWeaver 的其他 Issue

查看 Systemorph/MeshWeaver 的全部 Issue

相似的 Issue

更多 C# Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。