-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Restrict access by role to submissions_services_summary
#4212
Conversation
🤖 Hasura Change Summary compared a subset of table metadata including permissions: Updated Tables (1)
|
filter: | ||
team: | ||
flows: | ||
creator_id: | ||
_eq: x-hasura-user-id |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Users with the demoUser
role can only access the records for flows which they created.
filter: | ||
team: | ||
members: | ||
_and: | ||
- user_id: | ||
_eq: x-hasura-user-id | ||
- role: | ||
_eq: teamEditor |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Users with the teamEditor
role can only access records which are associated with teams where they hold the teamEditor
role.
Removed vultr server and associated DNS entries |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for this folowup ! Currently we were handling this permissions level in the editor-only (eg the "Submissions log" page/route is only accessble to teamEditors
of said team and platformAdmins
), but much more robust to have db select access in place too
Configures missing permissions, please see comments and #4211 (comment) for context.