Relationship Permissions are ignored when creating with relationship id

I've two collections - A and B. Created a many to one relationship attribute in A.

Collection A Permissions: create:user/verified

Collection B Permissions: none

✅ Case 1: Creating document in both A and B together Expected: 401, Actual: 401 - as user does not have create permission on collection B.

{
  "a_field1": "val",
  "b_collection_ref": {
    "b_field1": "val"
  }
}

❌ Case 2: Creating document in A alone. Document in B already exists, hence, use exisiting doc id. Expected: 401, Actual: 200. User does not have read permission on collection B / document in B. Ideally this operation should result in 401 but it succeeds and creates a document in A with relationship B.

{
  "a_field1": "val",
  "b_collection_ref": "b_doc_id"
}

@Drake Can you please take a look?

Please do not tag people as it can be disruptive

Sure. Is there a support alias?

Nope, people takes a look anyways when they can 😅

Isn't that expected? I don't understand the issue, sorry.

Thanks for looking into this. When creating / updating / reading both parent and child documents, user has to have permissions on both parent and child documents, but when linking the parent and child document through references, appwrite only checks if the user has permission on parent document. This could lead to security issue where user can link any child document without having necessary permissions on child document.

For example, let's say we have two collections Posts (parent) and Groups (child). User can create a document in posts and link it to any private group with out having permission on that private group document. In other words, any user can create a post in any group. So the question is why appwrite has to treat linking a child document through reference any different than the nested syntax?

Hmm ya I would expect the user to only be able to link to a document if they can read it

Yes, ideally user should have read permission on child document. What are the next steps on this? Shall I create an issue?

Oh, I understand now. Huge thanks for the detailed explanation! <:appwriteheart:782571497393750036>

Thanks for your support. Submitted an issue. https://github.com/appwrite/appwrite/issues/7263