Resgate does not make an access call on an indirectly subscribed resource after it turns to a solely directly subscribed resource.
Example
Let assume we have a resource test.parent with a resource reference to test.child:
Client subscribes to test.parent and gets test.child as an indirectly subscribed resource.
Client subscribes to test.child, which triggers no access request as it is also indirectly subscribed.
Client unsubscribes to test.parent, which turns test.child to a solely directly subscribed resource.
Resgate erroneously does not confirm client's access to test.child
Service sends a reaccess on test.parent, and denies access.
Client will continue to receive events for test.child even if access should have been revoked.
Impact
May have access control impact for solutions where reaccess is used on nested resources.
Solution
On unsubscribe, Resgate should check if any referenced resource is directly subscribed without any indirect reference. In such a case, Resgate should trigger a reaccess on the referenced resource.
jirenius
commented
5 years ago
Issue
Resgate does not make an access call on an indirectly subscribed resource after it turns to a solely directly subscribed resource.
Example
Let assume we have a resource
test.parentwith a resource reference totest.child:test.parentand getstest.childas an indirectly subscribed resource.test.child, which triggers no access request as it is also indirectly subscribed.test.parent, which turnstest.childto a solely directly subscribed resource.test.childtest.parent, and denies access.test.childeven if access should have been revoked.Impact
May have access control impact for solutions where
reaccessis used on nested resources.Solution
On unsubscribe, Resgate should check if any referenced resource is directly subscribed without any indirect reference. In such a case, Resgate should trigger a reaccess on the referenced resource.