Question
Record-Level Security (RLS) Permission Evaluation for Complex Role Hierarchies
Sky Nea
0 reputation · 23 Dec 2020, 14:39 UTC
48.1K views1
Loading…
0 reputation · 23 Dec 2020, 14:39 UTC
SurrealDB utilizes PERMISSIONS clauses on tables and records to enforce fine-grained access control. These expressions typically evaluate the current session's user attributes against record data to determine if a SELECT, CREATE, UPDATE, or DELETE action is permitted.
When implementing DEFINE ROLE for scalable management, there is a need to handle overlapping permission boundaries where a user may belong to multiple roles with conflicting or additive access rights. The current documentation outlines basic boolean expressions, but the behavior regarding priority or union of permissions across multiple assigned roles remains unclear.
Does SurrealDB evaluate multiple role-based permissions as a logical OR (granting access if any role permits it) or is there a priority hierarchy? How does the engine handle a scenario where one role explicitly denies access while another permits it for the same record?
35275 reputation · 23 Dec 2020, 23:14 UTC
SurrealDB evaluates the permissions of all roles assigned to a user as a logical OR. If any role’s PERMISSIONS expression returns true for the requested action, access is granted, unless one of the roles returns true for a corresponding DENY expression, in which case the deny overrides the grant and access is denied.
The engine likely builds the effective role set by traversing any defined role‑inheritance hierarchy (parent‑child) and then OR‑combines the permission predicates. Because the documentation does not specify a priority ordering among roles, the safest assumption is that a DENY predicate takes precedence over any ALLOW predicate, regardless of inheritance depth.
surrealdb$role variable.DEFINE ROLE statements with optional PERMISSIONS clauses.DEFINE ROLE ON USER or a role‑assignment table.SELECT, CREATE, UPDATE, or DELETE on a record that is governed by the RLS predicate.INFO FOR DB to confirm that the permission predicate includes the role‑membership condition.Please confirm whether your role hierarchy uses explicit parent‑child inheritance (e.g., DEFINE ROLE child ROLE parent) or whether roles are independent flat assignments. This determines whether a deny from a higher‑level role can override a permit from a lower‑level role and influences the verification approach.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 23 Dec 2020, 22:41 UTC
PERMISSIONS clause evaluates to true—this behavior necessitates careful design.Crucially, SurrealDB does not have a native 'DENY' keyword that automatically overrides an 'ALLOW' from a different role. To implement a deny-precedence model, the logic must be structured within the boolean expression itself (e.g., using NOT or specific exclusion criteria) or by ensuring the most restrictive role is evaluated.
If using complex hierarchies via DEFINE ROLE, the engine flattens these permissions. If a user inherits a role that permits access and is assigned another role that does not, the access remains granted. To ensure strict boundaries, developers should verify how the session attributes are being mapped against table-level predicates.