Hi everyone, We setup a couple users to generate access tokens for the roles admin, writer and reader. With the reader user, the UI looks correct and we were able to generate a token, however it still seems that it is able to hit all GMS endpoints. For example, I tried both

/entities?action=ingest

and

aspects?action=ingestProposal

and both went through successfully with the reader token. The GMS is validating the token because I tried the request with no token and then with an invalid one and these requests both got 401 errors. Also I noticed that trying a GraphQL mutate with the reader user was rejected, it's just the GMS calls that go through. Do the GMS endpoints check if the actor has the permissions to be making the call?

Here’s the relevant section on GraphQL auth from the GMS doc:

Note that the version of the API available via the

datahub-frontend-react

container is protected by Cookie-based Authentication, whereas the API living at the

metadata-service

is not behind any Authentication by default.