policy.public_grant_missing: A route that anyone may call, with no sign-in, reads or changes a record that only signed-in people are allowed to see

A route that anyone may call, with no sign-in, reads or changes a record that only signed-in people are allowed to see.

Area 9, Policy; not declinable; the next step is usually the human's.

Why Jadpo refuses it

Two things must agree before someone who isn't signed in can reach a record. The route must skip sign-in, with authentication: RouteAuthentication.none, and the entity's grant must name Access.public. Here the route lets anyone call it, but Article's read: names only Access.authenticated, so every call would be refused with 403.

Jadpo won't choose the fix for you. One fix makes every article readable by the whole world, and the other makes people sign in to read one.

What it looks like

main.jadpo:

example

type ArticleTitle = Text {    max_length: 120}type ArticleView = Output {    title: ArticleTitle}entity Article {    id: Uuid    title: ArticleTitle    policy: {        read: [Access.authenticated]    }}query find_article(article_id: Article.id) fails ArticleNotFound -> ArticleView {    from: Article    where: Article.id == article_id    missing: ArticleNotFound}routes Articles {    prefix: /articles    GET /{article_id: Article.id} {        authentication: RouteAuthentication.none        output: ArticleView        run: find_article(article_id)    }}

jadpo checkcheck failed: 1 error, 1 file

error GET /articles/{article_id} lets anyone call it, but not everyone may read Article

--> main.jadpo:27:5

   |27 |     GET /{article_id: Article.id} {   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ anyone may call it

reason: A route with authentication: RouteAuthentication.none has no caller, so everything it reaches needs Access.public; Article's read: doesn't name Access.public. Either alone is not enough.
next: Add Access.public to Article's read:, or remove authentication: RouteAuthentication.none from the route (human)
rule: policy.public_grant_missing
help: https://jadpo.dev/docs/errors/policy.public_grant_missing

(human) at the end of the next: line tells your coding agent to stop and ask you which fix you want, because the choice is yours to make: it decides who can read an article.

The same error is raised for an action the route runs whose line under actions: doesn't name Access.public. On a tenant's records the only fix it offers is sign-in, since every grant on them, Access.public included, applies only within the tenants where the caller has a membership.

How to fix it

The question is whether people must sign in to read an article.

If anyone at all may read an article, add Access.public to Article's read::

example

    policy: {        read: [Access.public]    }

GET /articles/{article_id} now answers anyone, signed in or not, with the article's title. Widening a grant needs a person's acceptance once the app is on its default branch (Protecting policy).

If only signed-in people may read one, remove authentication: RouteAuthentication.none from the route. The app must sign people in, so this example adds a principal and authentication { }:

example

    GET /{article_id: Article.id} {        output: ArticleView        run: find_article(article_id)    }

The route now needs a signed-in caller. A request without a valid token gets 401, and anyone signed in may read an article, as Article's read: says.

Why Jadpo refuses it

What it looks like

How to fix it

Related