anmot.Original post
Rank 1: Thread
I've two collections - A and B. Created a many to one relationship attribute in A.
Collection A Permissions:
create:user/verified
Collection B Permissions:
none
✅ Case 1: Creating document in both A and B together
Expected: 401, Actual: 401 - as user does not have create permission on collection B.
{
"a_field1": "val",
"b_collection_ref": {
"b_field1": "val"
}
}
❌ Case 2: Creating document in A alone. Document in B already exists, hence, use exisiting doc id.
Expected: 401, Actual: 200. User does not have read permission on collection B / document in B. Ideally this operation should result in 401 but it succeeds and creates a document in A with relationship B.
{
"a_field1": "val",
"b_collection_ref": "b_doc_id"
}
Summary
The user is experiencing an issue regarding relationship permissions in the Appwrite platform. When linking a parent and child document through references, Appwrite only checks if the user has permission on the parent document, which could lead to a security issue. The user expects that the user should only be able to link to a document if they have read permission on it. They have reported the issue and are asking for the next steps. The user provides an example of two collections (Posts and Groups), where any user can create a post in any group without having permission on that group. The user also shares two test cases with the expected and actual results. In
