SoftInstigate / restheart

Open Source Low-code API development framework Featuring ready-to-go Security and MongoDB API
http://softinstigate.github.io/restheart/
GNU Affero General Public License v3.0
792 stars 170 forks source link

Error on PATCH request using update operator expression when permission with mongo.mergeRequest applies #503

Open ujibang opened 4 months ago

ujibang commented 4 months ago

Describe the bug

PATCH requests allows the body to be an update operator expression or update aggregation pipeline. See https://restheart.org/docs/mongodb-rest/write-docs#mongodb-write-operations

When the request with operator expression is authorized by a permission specifying mongo.mergeRequest, the request fails.

To Reproduce

create test user and permission

$ http -a admin:secret :8080/users _id=test roles:='["test"]' password=secret
$ http -a admin:secret POST :8080/acl _id=testPermission roles:='["test"]' priority:=100 predicate="method(PATCH) and path-prefix('/test')" mongo.mergeRequest:='{ "author": "@user._id" }'

now try a PATCH on /test/doc with update operator expression; the request fails

$ http -a test:secret PUT :8080/test/doc a:=1  # create the doc
$ http -a test:secret PATCH :8080/test/doc "$set":='{"a": 2}'  # ===> this fails