Understanding a Critical ESHOPMAN Admin RBAC Bug: Silent Policy Revocations

The ESHOPMAN community recently identified and discussed a significant issue concerning Role-Based Access Control (RBAC) within the ESHOPMAN Admin dashboard. This particular bug impacts how administrators manage permissions, specifically when attempting to revoke policies from roles.

Understanding the Silent Policy Revocation Failure

When ESHOPMAN's RBAC feature is enabled, administrators might encounter a peculiar problem: revoking a policy from a role via the Roles → Manage permissions form appears successful in the user interface, but the change is not actually saved. This silent failure occurs for any policy that falls outside the initial set of 20 assignable policies.

The issue manifests as follows:

• An administrator unchecks a policy to revoke it and clicks 'Save'.
• The modal closes, indicating success.
• However, no actual deletion request is sent to the ESHOPMAN Admin API.
• Upon reloading or re-checking the role, the policy remains assigned.
• Granting new policies, even within the same save operation, works correctly, making the revocation failure easy to overlook.

The Technical Deep Dive: Why it Happens

A detailed investigation revealed the root cause lies in how the ESHOPMAN Admin UI component computes the set of policies to be removed. The component fetches a list of "assignable policies" to determine which policies can be stripped. Crucially, this fetch is performed without specifying a limit parameter.

The ESHOPMAN Admin API, by default, applies a limit of 20 policies when no specific limit is provided for this endpoint (/admin/rbac/policies/assignable). Consequently, the Admin UI component only ever receives the first 20 assignable policy IDs. When the system attempts to identify policies to revoke, it filters these against the truncated list of 20 IDs. Any policy outside this initial set is effectively ignored during the revocation process, leading to the silent failure.

This behavior is evident in the ESHOPMAN Admin UI component's source code, specifically in the logic that constructs the removal set:

    // Unpaginated assignable id set, used only to scope the diff on submit so we
    // never strip policies the actor cannot see.
    const { data: allAssignable, isPending: isAssignableSetLoading } =
      useRbacAssignablePolicies()
    const assignableIds = useMemo(
      () => new Set((allAssignable?.policies ?? []).map((p) => p.id)),
      [allAssignable?.policies]
    )

    // ... later in the code ...

    const toRemove = existingPolicies
      .filter((policyId) => assignableIds.has(policyId))
      .filter((policyId) => !selectedPolicies.includes(policyId))

The assignableIds set, due to the backend's default limit, never contains more than 20 IDs. This means that if a user tries to revoke a policy whose ID is not in this set, the assignableIds.has(policyId) check will fail, and the policy will not be added to the toRemove list.

Impact and Proposed Solutions

This isn't an edge case; a standard ESHOPMAN installation ships with over 232 unique built-in policies. This means that, by default, administrators are unable to revoke the vast majority of these policies through the Admin dashboard when RBAC is active.

The ESHOPMAN team is investigating this bug. Two primary solutions have been discussed:

1. Admin UI Component Fix (Preferred): Modify the ESHOPMAN Admin UI component to explicitly request the full set of assignable policies when computing revocations. This could involve passing a sufficiently large limit parameter or paginating through the results to collect all IDs.
2. Backend API Adjustment: Increase the default limit for the /admin/rbac/policies/assignable endpoint or introduce a specific mode to return all policies.

While a temporary workaround might involve applying a large limit via a custom backend middleware, the consensus leans towards fixing the Admin UI component to explicitly request the complete dataset it needs.

This discussion highlights the importance of thorough testing and community collaboration in identifying and resolving critical issues to ensure a robust and reliable ESHOPMAN experience for all users.