GeezerVison is showing github.com — Update permissions aren't being enforced in registry server · Issue #4444 · feast-dev/feast
Update permissions aren't being enforced in registry server #4444
Description
Current Behavior
apply_x methods in registry server check permissions on the object that's passed in the request. This is correct for object creation, but overlooks updates. During updates we should be checking permissions on the existing object as well. With current behavior, user is allowed to overwrite objects even when updates aren't allowed.
Possible Solution
Pseudocode for a typical apply method should look something like this:
- Check if the object already exists in the registry
- Assert update permission on the existing object (if it exists)
- Assert create permission on the object contained in the request
- Proceed with apply
Activity
dmartinol commented on Aug 26, 2024
@tokoko could you explain why the following code is not covering the update use case?
self.proxied_registry.apply_entity(
entity=cast(
Entity,
assert_permissions(
resource=Entity.from_proto(request.entity),
actions=CRUD,
),
),
project=request.project,
commit=request.commit,
)IIUC, it runs the assert check before trying the apply, so the update should not happen if not authorized.
tokoko commented on Aug 26, 2024
CollaboratorAuthor
More actions
The problem isn't the order, it's the fact that assert is happening on a wrong object. Say I have an update permission on objects tagged like {"team": "A"} and I'm applying an update to an entity that already exists and is tagged like {"team": "B"}. The code above checks only the fact that I'm authorized to create entities of team A and overwrites team B's object because existing object is never touched during permission assertion.
There should be two separate asserts, one on the object that's already in the registry and another one on the object that's supplied as part of the request.
Reacted by Daniele Martinoli
dmartinol commented on Aug 26, 2024
Reacted by Tornike Gurgenidze
Metadata
Metadata
Development
No branches or pull requestsIssue actions