This error occurs on the currently deployed "production" beta PMD deployment for ONS. NOTE that the deployed version where this occurs is https://github.com/Swirrl/drafter/releases/tag/v2.6000001 and is prior to the RBAC changes on master.
This is what the error looks like, when you make a request like this to drafters API /v1/draftsets?include=claimable or /v1/draftsets?include=all.
It appears that this issue is caused by configuring an m2m user with both the old style monolithic permissions/roles e.g. drafter:editordrafter:publisher, and the new style fine-grained permissions. The RBAC pr #610 attempted for deployments sake to try and ensure that old and new style permissions could be run in tandem (with a migration). We also believed that it should be possible to run old drafters with auth0 permissions configured in both styles, however it may be the case that this combination escaped testing.
@RicSwirrl had added new style permissions to auth0 on the beta site (above) as prep for updating the code and migrating to the granular permissions model. When that occurred the above error started happening. We have currently not identified why this results in the above SPARQL error, as the queries involved are not parameterised in this way (only by email).
I'm writing this bug up to capture it; but it may be that we don't need to fix it, as if we roll forward to a more recent drafter release it is likely no longer to be an issue.
Below are the combination of auth0 permissions which will result in the above error:
Closing this as this version of the code is not in deployment any more. It looks like the old code didn't like the more granular permissions co-existing with the macro-level perms like drafter:edtior.
This error occurs on the currently deployed "production" beta PMD deployment for ONS. NOTE that the deployed version where this occurs is https://github.com/Swirrl/drafter/releases/tag/v2.6000001 and is prior to the RBAC changes on master.
This is what the error looks like, when you make a request like this to drafters API
/v1/draftsets?include=claimable
or/v1/draftsets?include=all
.See Swirrl slack discussions here and on ONS slack here.
RBAC
It appears that this issue is caused by configuring an m2m user with both the old style monolithic permissions/roles e.g.
drafter:editor
drafter:publisher
, and the new style fine-grained permissions. The RBAC pr #610 attempted for deployments sake to try and ensure that old and new style permissions could be run in tandem (with a migration). We also believed that it should be possible to run old drafters with auth0 permissions configured in both styles, however it may be the case that this combination escaped testing.@RicSwirrl had added new style permissions to auth0 on the beta site (above) as prep for updating the code and migrating to the granular permissions model. When that occurred the above error started happening. We have currently not identified why this results in the above SPARQL error, as the queries involved are not parameterised in this way (only by
email
).I'm writing this bug up to capture it; but it may be that we don't need to fix it, as if we roll forward to a more recent drafter release it is likely no longer to be an issue.
Below are the combination of auth0 permissions which will result in the above error: