Failing due to unrequired security check in transacted DB (in non-transacted - OK)

[PhantomYdn]

OrientDB Version: 2.2.30

Java Version: 8

OS: ubuntu

OrientDB require rights where security check is not needed.
There is a class with link to OUser. Suppose you are trying to create a new document of this class and point to some user under 'writer'. For unknown reason: transacted db DO require write rights for OUser disregard that fact that it's just referencing to OUser.

Here is the test. It's using Orienteer tester class for accessing DB, but it's should not be a big problem to rewrite.

@Test
	public void testLinkToOUser() {
		ODatabaseDocument db = wicket.getTester().getDatabase();
		OSchema schema = db.getMetadata().getSchema();
		final OClass classA = schema.createClass("TestLinkToOUser");
		classA.createProperty("name", OType.STRING);
		classA.createProperty("user", OType.LINK).setLinkedClass(schema.getClass("OUser"));

		ORID userRid = new ORecordId("#5:0");
		ODocument doc = new ODocument(classA);

		wicket.getTester().signIn("writer", "writer");
		db = wicket.getTester().getDatabase();
		db.begin(); // If comment this line - everything is fine
		ODocument userDoc = userRid.getRecord();
		userDoc.field("roles"); // It's required to get DirtyManager instantiated with OUser doc in it, but operation them-self is read-only, as you see
		doc.field("Admin");
		doc.field("user", userDoc); //I do know that it's possible to set OIdentity instead of ODocument, but it's not the goal of this issue
		doc.save();
		db.commit();
	}

Expected behavior

OrientDB should allow to save documents with just links to OUser (or other RO instances)

Actual behavior

OrientDB is failing to set this link in transacted DB. In non-transacted, everything is fine.

P.S. writer should have ReadOnly rights to OUser

[jcwright77]

I encountered a similar issue where non-admin users could not read a record with links to OUser. I had assumed that was deliberate behavior. -john wright On Feb 4, 2018, at 10:13 PM, Ilia Naryzhny <[email protected]<mailto:[email protected]>> wrote: OrientDB Version: 2.2.30 Java Version: 8 OS: ubuntu OrientDB require rights where security check is not needed. There is a class with link to OUser. Suppose you are trying to create a new document of this class and point to some user under 'writer'. For unknown reason: transacted db DO require write rights for OUser disregard that fact that it's just referencing to OUser. Here is the test. It's using Orienteer tester class for accessing DB, but it's should not be a big problem to rewrite. @test public void testLinkToOUser() { ODatabaseDocument db = wicket.getTester().getDatabase(); OSchema schema = db.getMetadata().getSchema(); final OClass classA = schema.createClass("TestLinkToOUser"); classA.createProperty("name", OType.STRING); classA.createProperty("user", OType.LINK).setLinkedClass(schema.getClass("OUser")); ORID userRid = new ORecordId("#5:0"); ODocument doc = new ODocument(classA); wicket.getTester().signIn("writer", "writer"); db = wicket.getTester().getDatabase(); db.begin(); ODocument userDoc = userRid.getRecord(); userDoc.field("roles"); doc.field("Admin"); doc.field("user", userDoc); doc.save(); db.commit(); } Expected behavior OrientDB should allow to save documents with just links to OUser (or other RO instances) Actual behavior OrientDB is failing to set this link in transacted DB. In non-transacted, everything is fine. P.S. writer should have ReadOnly rights to OUser — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#8067>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AH8lzc9ULuhFNOMjUbZhm3hKzLNKf3Ytks5tRnHwgaJpZM4R43bw>.

[PhantomYdn]

@jcwright77 , your case is also weird.

1. If you have read-only rights to classA and read-write to classB: you should be able to do everything with instance of classB.
2. If you dont't have any rights for classA and read-only for classB: you should be able at least read instances of classB, but links to classA should remain unresolved if you do document.field("link")

[jcwright77]

Let me correct that. The case is class A with read-write, class B no access. class A has a link to a class B record. User can retrieve class A including the link rid to class B, just not retrieve linked class B record. In my hazy recollection, the first query was failing but it is works. I think this is the expected and reasonable behavior. User *cannot* do something like retrieve Person.ouser.name if ouser is not accessible by them, but they can get the rid of the ouser link field. sorry for any confusion.

…

-john wright

On Feb 6, 2018, at 12:50 AM, Ilia Naryzhny ***@***.***> wrote: @jcwright77 , your case is also weird. • If you have read-only rights to classA and read-write to classB: you should be able to do everything with instance of classB. • If you dont't have any rights for classA and read-only for classB: you should be able at least read instances of classB, but links to classA should remain unresolved if you do document.field("link") — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[PhantomYdn]

Let me make clear for the supporters: that it's different. And in my case: I think that expected behaviour should be as I stated in my previous post.

[PhantomYdn]

@tglman , what's your oppinion about the issue?