🐛 Bug report: Fine-Grained Token Creation Allows Incomplete Permission Assignment
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
Bug Report: Fine-Grained Token Creation Allows Incomplete Permission Assignment
Summary
Fine-grained token creation only validates that at least one permission value is assigned somewhere in the form. It does not validate whether every selected resource has a permission value assigned. This leads to inconsistent behaviour between new-token and token-duplication flows, and can cause users to believe unassigned permissions were successfully added.
Observed Behaviour (See videos 📹 👀 )
Three scenarios were tested:
| Scenario | Result |
|---|---|
| 1. Create a token from scratch with no resources assigned a permission value | |
| 2. Create a token from scratch with one resource assigned a permission value, while other selected resources have no permission assigned | |
| 3. Duplicate a token and add new resources without assigning permission values |
-
Create a token from scratch with no resources assigned a permission value
-
Create a token from scratch with one resource assigned a permission value, while other selected resources have no permission assigned
- Duplicate a token and add new resources without assigning permission values
Steps to Reproduce
Scenario 2 – Partial permission assignment on new token:
- Navigate to fine-grained token creation.
- Select multiple resources.
- Assign a permission value to only one resource, leaving others unassigned.
- Submit the form.
- Result: Token is created successfully despite incomplete permission assignment.
Scenario 3 – Duplicate token with unassigned added resources:
- Duplicate an existing fine-grained token.
- Add one or more new resources without assigning permission values.
- Submit the form.
- Result: Token is created successfully. The newly added resources are silently ignored, producing an unchanged duplicate.
Expected Behaviour
- Token creation should fail validation when any selected resource is missing a permission value.
- A clear warning message should be displayed, identifying which resource(s) have incomplete permission selections.
- This behaviour should be consistent across both the new-token creation flow and the token-duplication flow.
Impact
- Users may incorrectly believe that resources with unassigned permissions were successfully added to the token.
- Silent failures during token duplication can result in tokens that do not behave as intended.
- Inconsistent validation logic creates an unreliable user experience.
Type
- Bug
- Category: Workflow logic / Form validation
Additional Context
The root cause appears to be that the validation logic checks for the presence of at least one assigned permission rather than verifying that all selected resources have a permission value assigned. The fix should enforce complete permission assignment for every selected resource before allowing token creation to proceed.