GHSA-grjv-gjgr-66g2
SpiceDB exclusions can result in no permission returned when permission expected
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/authzed/spicedb | < 1.33.1 | 1.33.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Background
Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.
For example, given this schema:
```zed
definition user {}
definition folder {
relation member: user
relation banned: user
permission view = member - banned
}
definition resource {
relation folder: folder
permission view = folder->view
}
```
If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned
### Impact
Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API.
### Workarounds
None
References
External links from the advisory. They lead to third-party sites.