insights: dashboards can be edited to be unviewable from the user

sourcegraph / sourcegraph-public-snapshot

Code AI platform with Code Search & Cody

https://sourcegraph.com

Other

10.1k stars 1.29k forks source link

insights: dashboards can be edited to be unviewable from the user #26436

Open coury-clark opened 3 years ago

coury-clark commented 3 years ago

The insights dashboard API allows input to modify the grants available. This has the consequence that it is possible to create or modify a dashboard such that the user initiating the request will no longer be able to view the dashboard. Currently, this violates the GraphQL schema for a non-null dashboard response.

Some context

We should come up with a solution that either enforces the non-null invariant in a consistent way, or otherwise prevent this action from happening.

github-actions[bot] commented 3 years ago

Heads up @joelkw @felixfbecker @vovakulikov @unclejustin - the "team/code-insights" label was applied to this issue.