Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: GraphQL does not properly constrain on getter #212

Closed
DanSheps opened this issue Sep 17, 2024 · 3 comments
Closed

[Bug]: GraphQL does not properly constrain on getter #212

DanSheps opened this issue Sep 17, 2024 · 3 comments
Labels
bug Something isn't working

Comments

@DanSheps
Copy link
Member

NetBox access-list plugin version

v1.6.1

NetBox version

v4.1.1

Steps to Reproduce

Make a graphql request to plugin requesting a specific object which you don't have permissions to

Expected Behavior

Denied access

Observed Behavior

Object returned

@DanSheps DanSheps added the bug Something isn't working label Sep 17, 2024
Copy link

Thanks for opening this Issue! We really appreciate the feedback & testing from users like you!

@DanSheps
Copy link
Member Author

To fix:
schema.py

-    @strawberry.field
-    def access_list(self, id: int) -> AccessListType:
-        return AccessList.objects.get(pk=id)
+    access_list: AccessListType = strawberry_django.field()
-    @strawberry.field
-    def acl_extended_rule(self, id: int) -> ACLExtendedRuleType:
-        return ACLExtendedRule.objects.get(pk=id)
+    acl_extended_rule: ACLExtendedRuleType = strawberry_django.field()
-    @strawberry.field
-    def acl_standard_rule(self, id: int) -> ACLStandardRuleType:
-        return ACLStandardRule.objects.get(pk=id)
+    acl_standard_rule: ACLStandardRuleType = strawberry_django.field()

@cruse1977
Copy link
Member

`PATCH a single object without permission. ... ok
test_root (netbox_acls.tests.test_api.AppTest.test_root) ... ok

======================================================================
FAIL: test_graphql_get_object (netbox_acls.tests.test_api.ACLTestCase.test_graphql_get_object)

Traceback (most recent call last):
File "/opt/netbox/venv/lib/python3.11/site-packages/django/test/utils.py", line 443, in inner
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/opt/netbox/netbox/utilities/testing/api.py", line 566, in test_graphql_get_object
self.assertNotIn('errors', data)
AssertionError: 'errors' unexpectedly found in {'data': None, 'errors': [{'message': "Unknown argument 'id' on field 'Query.access_list'.", 'locations': [{'line': 3, 'column': 29}]}]}


Ran 22 tests in 0.675s
`

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants