Wrong database when checking permissions

[krand-dsa]

Hi,
I'd like to point to a discussion I opened in spatie/laravel-multitenancy

The bottom line is:
I'm using

• laravel/framework 11.15.0
• filament/filament 3.2.93
• spatie/laravel-permission 6.9.0
• spatie/laravel-multitenancy 4.0.0

In laravel-multitenancy I use separate databases for landlord and tenants.

When I check permissions in my UserPolicy of the tenant the function HasPermissions::getAllPermissions() correctly uses the tenant database, while HasPermissions::hasPermissionTo() and subsequently also $user->can() incorrectly uses the landlord database and refuses to grant access.

I'm not sure if this is an laravel-multitenancy or laravel-permission issue, therefore the pointer.

Thanks in advance for any hints, how I could solve the issue!
krand

[drbyte]

I think it'd be helpful to have access to actual source code in order to sort this out. (run xdebug, trace things through, etc).

Ideally a simple new repo with a simple app that demonstrates this problem would be best, and doesn't expose any proprietary project logic etc. That would also let us add some specific tests as well.

But if it's easier for you to privately share the entire code base project, you can zip it and upload it to me via dropbox. I'll stage it locally for debugging, and destroy all copies when done. Here's a dropbox upload folder: https://www.dropbox.com/request/xmpVVZNeMGFuv1nWobwz

[krand-dsa]

Hi @drbyte
thanks for your willingness to help! I created a demonstration project at https://github.com/krand-dsa/db_permission_test, that demonstrates the behavior with filamentphp as well as with a blade template.

Best, krand

[drbyte]

Okay. My week is pretty full, but I'll take a look as soon as I can.

[BillRamos]

I was able to get around this issue by overwriting the roles() and permissions() relation definitions directly on my User model to manually specify the correct database to use, though this solution isn't ideal because any changes to those methods in new versions of the permissions package will likely be breaking.

I don't use the mutitenancy package, so treat this example below as pseudocode. I looked into your example project and the multitenancy documentation briefly, but I haven't tested this at all. It's using the getConnectionName() method from the Spatie\Multitenancy\Concerns\UsesMultitenancyConfig trait, which is inherited by Spatie\Multitenancy\Models\Concerns\UsesTenantConnection which is then inherited by your App\Models\tenants\User model to determine the database to use when referencing the relation.

User.php:

public function roles(): BelongsToMany
{
    $relation = $this->setConnection($this->getConnectionName())->morphToMany(
        config('permission.models.role'),
        'model',
        config('permission.table_names.model_has_roles'),
        config('permission.column_names.model_morph_key'),
        app(PermissionRegistrar::class)->pivotRole
    );

    ...

}

public function permissions(): BelongsToMany
{
    $relation = $this->setConnection($this->getConnectionName())->morphToMany(
        config('permission.models.permission'),
        'model',
        config('permission.table_names.model_has_permissions'),
        config('permission.column_names.model_morph_key'),
        app(PermissionRegistrar::class)->pivotPermission
    );

    ...

}

Again... Not ideal, but could help you in the short term.

[krand-dsa]

Thanks for your efforts @BillRamos
I testet the workaround with the test application. Unfortunately it doesn't better the situation.

Also in the original setup the User has the correct connection (as $user->getConnectionName() shows) and access to the correct roles and permissions.
The problem seems to be somewhere in the difference of the inner workings of $user->getAllPermissions(), which produces correct results, and $user->hasPermissionTo('list.users'), which produces incorrect results.

[krand-dsa]

Problem:
laravel-multitenancy supports to have separate databases for the landlord and each of the tenants. It also provides tasks that can be run when switching to/from a tenant in order to set the database connection and other configs as needed. In my case the database switching was done correctly and the User model was aware which database connection (the tenant one) to use. This is done by using the UsesTenantConnection trait.
The User model also uses the HasRoles trait of laravel-permission, which itself uses the HasPermissions trait. HasPermissions provides the hasPermissionTo function, which is used to check if a user has a certain permission. The inner workings of this function ignore the database connection that is set for the User (see above) and use the default database connection instead (the landlord DB in my case). Therefore permissions for tenants cannot be found / matched correctly and a PermissionDoesNotExist Exception is thrown.

Solution (at least for my case):

1. Create custom Permission- and Role-Models for tenants, which extend the respective Models of laravel-permission and in addition use the UsesTenantConnection trait of laravel-multitenancy.
2. Make the permission-config tenant-aware: Create a task for laravel-multitenancy to replace the default config of permission.models.permission and permission.models.role with the respective custom models created in 1. and add this task to switch_tenant_tasks in the multitenancy-config.

Note: if the default DB-connection is not the landlord connection it might be necessary to take care of this as well. In my case the default is landlord and the default settings of the permission config (use the Models of the package) work fine for the landlord.