target / goalert

Open source on-call scheduling, automated escalations, and notifications so you never miss a critical alert
https://goalert.me
Apache License 2.0
2.17k stars 230 forks source link

User Profile Access Denied when Creating Too Many Services #3870

Closed mastercactapus closed 1 month ago

mastercactapus commented 1 month ago

Describe the Bug: The issue arises when a user is assigned to too many escalation policies. There's an error note "access denied: exceeded auth check limit" that prevents the user and others from accessing/editing the problematic user's profile page. This problem appears to be related to the 'assignedTo' part of the query from the 'profileInfo' query.

Steps to Reproduce:

  1. Create many services (user will be assigned by default)
  2. Go to User Profile Page
  3. Attempt to view or edit user's profile
  4. See error "access denied: exceeded auth check limit"

Expected Behavior: Users should be able to create services up to a reasonable limit without encountering errors and access should remain unaffected for them and other users to view/edit a particular user's profile.

Observed Behavior: When a user creates too many services, both that user and others become unable to access or edit the problematic user's profile receiving the error "access denied: exceeded auth check limit".

Potential Solution: Look into optimization in the 'assignedTo' part of 'profileInfo' query to resolve this. Alternatively, for the profile page, it may be better to add a field that simply returns the number of assigned services (since this is the actual needed data) which could be handled far more efficiently in the backend.

Application Version: This issue affects the master branch of GoAlert.

Additional Context: There's no defined practical limit for creating services. As a temporary solution, removing the user from escalation policies/schedules/rotations associated with services will restore the profile.