error data-rights

Неверные права на данные.

What it means#

@owner(.field, bypass: [.Role, …]) marks a table whose rows belong to a user: the field holds the owner's user id, and the roles in bypass see every row. @visible(role: .Role) marks a field that is sent only to callers who have that role. The compiler checks that

• the field named by @owner exists and the type is a @table;
• the roles are variants of the application's role enum, the one given by roles from claim("…") as AppRole in cluster { auth { … } } (a program without that declaration has no role type);
• an @visible field is optional or has a default value, because a caller without the role does not receive it.

Example#

enum AppRole { Admin, HR }

@table("orders") @owner(.owner, bypass: [.Boss])   // <- data-rights: `AppRole` has no role `Boss`
data Order { @pk id: i64; userId: str }

data Employee { @visible(role: .HR) salary: i64 }  // <- data-rights: must be optional or have a default

data-rights

How to fix#

Name an existing field and role: @owner(.userId, bypass: [.Admin]), and make the field optional: salary: i64?.

See also#

• cluster-auth
• missing-policy