On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.
For example, given this schema:
definition user {}
definition office {
relation parent: office
relation manager: user
permission read = manager + parent->read
}
definition group {
relation parent: office
permission read = parent->read
}
definition document {
relation owner: group with equals
permission read = owner->read
}
caveat equals(actual string, required string) {
actual == required
}
and these relationships:
office:headoffice#manager@user:maria
office:branch1#parent@office:headoffice
group:admins#parent@office:branch1
group:managers#parent@office:headoffice
document:budget#owner@group:admins[equals:{"required":"admin"}]
document:budget#owner@group:managers[equals:{"required":"manager"}]
Permission for 'document:budget#read@user:maria with {"actual" : "admin"}'
is returned as NOPERMISSION when HASPERMISSION is the correct answer.
Upgrade to v1.44.2.
Do not use caveats in your schema over an arrow’ed relation.
{ "nvd_published_at": "2025-06-06T18:15:35Z", "cwe_ids": [ "CWE-358" ], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2025-06-06T21:41:00Z" }