)]}'
{"id":"query-ui~242881","triplet_id":"query-ui~trinity~Ie495af092f4330b7388060b265251e4a14f58db2","project":"query-ui","branch":"trinity","attention_set":{},"removed_from_attention_set":{"1002967":{"account":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"last_update":"2026-04-13 21:15:44.000000000","reason":"\u003cGERRIT_ACCOUNT_1002967\u003e replied on the change","reason_account":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}},"1005387":{"account":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"last_update":"2026-04-13 13:58:40.000000000","reason":"removed on reply"}},"hashtags":[],"change_id":"Ie495af092f4330b7388060b265251e4a14f58db2","subject":"MB-71275 - better permissions handling in the document editor","status":"MERGED","created":"2026-04-06 23:04:57.000000000","updated":"2026-04-13 21:18:50.000000000","submitted":"2026-04-13 21:18:50.000000000","submitter":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"total_comment_count":12,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"242881","meta_rev_id":"e353b5bf7dec472bf363263145a54cc5530a5553","_number":242881,"virtual_id_number":242881,"owner":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"actions":{},"labels":{"Verified":{"approved":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"all":[{"tag":"autogenerated:gerrit:merged","value":1,"date":"2026-04-13 21:18:50.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},{"value":0,"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},{"value":0,"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}],"values":{"-1":"Fails"," 0":"No score","+1":"Verified"},"description":"","default_value":0},"Code-Review":{"approved":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"all":[{"value":0,"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},{"value":0,"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},{"tag":"autogenerated:gerrit:merged","value":2,"date":"2026-04-13 21:18:50.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}],"values":{"-2":"Do not submit","-1":"I would prefer that you didn\u0027t submit this"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0},"Well-Formed":{"approved":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},{"tag":"autogenerated:gerrit:merged","value":1,"date":"2026-04-13 21:18:50.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},{"value":0,"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}],"values":{"-1":"Commit is not well-formed"," 0":"Well-formedness not checked","+1":"Commit is well-formed"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-06 23:05:08.000000000","updated_by":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"reviewer":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-04-09 11:36:29.000000000","updated_by":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"reviewer":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"state":"REVIEWER"}],"messages":[{"id":"45a35aacb9eea81888ebb96d0204378e7c06dcfd","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-06 23:04:57.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c01b28d7fb8359dcb01330f2ec113715b9631262","author":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"date":"2026-04-06 23:05:08.000000000","message":"Patch Set 1: Well-Formed-1\n\nBranch restricted. PLEASE READ this URL: \n\nhttps://server.jenkins.couchbase.com/job/restricted-branch-check/512653/artifact/restriction/restricted.html : FAILURE","accounts_in_message":[],"_revision_number":1},{"id":"b17bdabd5e0c1ea413735659dfbfb563c0242dd9","author":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-09 11:36:29.000000000","message":"Patch Set 1: Code-Review+2\n\n(4 comments)","accounts_in_message":[],"_revision_number":1},{"id":"0ab31c3fa9fc4a1be505ec00687c131979ba43fb","author":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-09 11:36:38.000000000","message":"Patch Set 1: Verified+1","accounts_in_message":[],"_revision_number":1},{"id":"18790fb09413cb05b2875e64747b5bb74741f68d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-10 04:25:42.000000000","message":"Uploaded patch set 2.\n\nCopied Votes:\n* Well-Formed-1 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR **is:MIN**\")\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:NO_CHANGE OR changekind:NO_CODE_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified+1 (copy condition: \"changekind:NO_CHANGE OR changekind:NO_CODE_CHANGE\")\n","accounts_in_message":[],"_revision_number":2},{"id":"90581d837d00a678289d89c15de71970536a0935","author":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"date":"2026-04-10 04:25:55.000000000","message":"Patch Set 2: Well-Formed-1\n\nBranch restricted. PLEASE READ this URL: \n\nhttps://server.jenkins.couchbase.com/job/restricted-branch-check/513577/artifact/restriction/restricted.html : FAILURE","accounts_in_message":[],"_revision_number":2},{"id":"b3181e7210eb06cf30fe9c142ca319a57d855f3c","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-10 04:26:19.000000000","message":"Patch Set 2: Verified+1\n\n(5 comments)","accounts_in_message":[],"_revision_number":2},{"id":"7d04d1b5077932d9d215b48b1fc9b2d62b239af3","author":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-13 13:58:40.000000000","message":"Patch Set 2: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"9c4735da1e9dbcc02529691d2910e8a31eb8e60e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-13 19:48:47.000000000","message":"Patch Set 3: Commit message was updated.\n\nCopied Votes:\n* Code-Review+2 (copy condition: \"changekind:NO_CHANGE OR **changekind:NO_CODE_CHANGE** OR changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified+1 (copy condition: \"changekind:NO_CHANGE OR **changekind:NO_CODE_CHANGE**\")\n* Well-Formed-1 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR **is:MIN**\")\n","accounts_in_message":[],"_revision_number":3},{"id":"98c6f58844290ad88dbf88b4e87cb92c0e438cbc","author":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"date":"2026-04-13 19:48:58.000000000","message":"Patch Set 3: Well-Formed-1\n\nBranch restricted. PLEASE READ this URL: \n\nhttps://server.jenkins.couchbase.com/job/restricted-branch-check/514320/artifact/restriction/restricted.html : FAILURE","accounts_in_message":[],"_revision_number":3},{"id":"9232dace2dac50d7462d2620f5894d314a2d0502","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-13 21:15:44.000000000","message":"Patch Set 3: Verified+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"988bce4b0abe722d42c8d17e48ad25f1a24ad096","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-13 21:17:38.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"613c63dc7f2a0b6ed9efb353b62a664caf8b1839","author":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]},"date":"2026-04-13 21:17:48.000000000","message":"Patch Set 3: Well-Formed+1\n\nPermission granted to commit: \n\nhttps://server.jenkins.couchbase.com/job/restricted-branch-check/514329/artifact/restriction/restricted.html : SUCCESS","accounts_in_message":[],"_revision_number":3},{"id":"e353b5bf7dec472bf363263145a54cc5530a5553","tag":"autogenerated:gerrit:merged","author":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"date":"2026-04-13 21:18:50.000000000","message":"Change has been successfully cherry-picked as dcb5f79bdfc8ec20253267bdfdfe4761fc8f47f4\n\n2 is the latest approved patch-set.\nNo files were changed between the latest approved patch-set and the submitted one.\n","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"dcb5f79bdfc8ec20253267bdfdfe4761fc8f47f4","revisions":{"d1ccbcab8ed20059df4b4db1dc02eb8a180218bc":{"kind":"REWORK","_number":1,"created":"2026-04-06 23:04:57.000000000","uploader":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"ref":"refs/changes/81/242881/1","fetch":{"anonymous http":{"url":"https://review.couchbase.org/query-ui","ref":"refs/changes/81/242881/1","commands":{"Branch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/1 \u0026\u0026 git checkout -b change-242881 FETCH_HEAD","Checkout":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.couchbase.org/query-ui refs/changes/81/242881/1","Reset To":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"4d5aa4191412521671f6b944a114389aec4f8a96","subject":"MB-71194 - Fix location and size of query plan tool tips"}],"author":{"name":"ebenhaber","email":"eben@couchbase.com","date":"2026-04-06 22:34:00.000000000","tz":-420},"committer":{"name":"ebenhaber","email":"eben@couchbase.com","date":"2026-04-06 22:34:00.000000000","tz":-420},"subject":"MB-71725 - better permissions handling in the document editor","message":"MB-71725 - better permissions handling in the document editor\n\nThis issue came out of CBSE-22470, where a customer noted problems\nwith a user who lacked `collections!read` permission on some buckets,\nbut had the permission for other buckets. The bucket/scope/collection\nmenu in the documents page would allow the user to select both\npermitted and non-permitted buckets, but no scopes/collections were\nshown for the non-permitted buckets.\n\nThe user in question had permissions for Query System Catalog, but the\nUI was trying to use the non-permitted `/pools/default` endpoint to\nretrieve the list of scopes and collections for the bucket.\n\nThe UI would default to the `pools/default` endpoint if the user had\n\u0027cluster.collection[.:.:.].collections!read\u0027 permissions, which means\nthe right to list scopes/collections for at least one bucket. But that\ndoesn\u0027t mean that they have the right to list scopes/collections for\n*every* bucket.\n\nThe code has been unchanged for the past 4 years, and this is the\nfirst time a customer has run into the problem. However, it looks like\nthe use of permissions in the document editor was never really correct\nafter the addition of collections in release 7.0.\n\nProblem 1: there are two separate APIs to list scopes/collections,\nwhich require *different* permissions. The `/pools/default/buckets`\nendpoint requires \u0027cluster.collection[bucket:.:.].collections!read\u0027\npermission. However, the same information can be retrieved from the\nquery service if the user has the \u0027Query System Catalog\u0027 role. A user\nmight have one of those permissions but not both, thus the code must\ncheck and use the appropriate endpoint.\n\nProblem 2: there are two separate APIs for retrieving documents. A\nuser with only \u0027data.docs!read\u0027 permission can\u0027t use the query\nendpoint, but a user with \u0027n1ql.select!execute\u0027 can use either the\nquery endpoint or \u0027/pools/default/buckets\u0027. And of course these\npermissions are independent of those described in Problem 1.\n\nProblem 3: to determine whether to permit document editing, the UI was\nonly checking bucket-level permissions, and not collection-level\npermissions. Thus it might allow the user to try and edit a document\nin a read-only collection if there was some other collection in the\nbucket that is writeable. The back-end would prevent the edit, but\nthat doesn\u0027t look good.\n\nSolution 1: Retrieve the \u0027collections!read\u0027 permission for every\nbucket when the document editor is initialized. The code was already\nretrieving whether the user has Query Sytem Catalog, so now the code\ncan determine if the user has permission to fetch scope/collections,\nand if so which of the two APIs to use.\n\nSolution 2: Whenever a collection is selected in the document editor,\nif needed fetch the permissions for that specific collection\nw.r.t. \u0027docs!read\u0027, \u0027docs!upsert\u0027, \u0027docs!delete\u0027, and\n\u0027n1ql.select!execute\u0027. With this information the code knows which APIs\nare available for fetching documents, and whether the documents are\nread-only, read-write, or write-only. (Yes, it is actually possible to\ncreate documents in a collection where the user doesn\u0027t have read\naccess!)\n\nChange-Id: Ie495af092f4330b7388060b265251e4a14f58db2\n"},"parents_data":[{"branch_name":"refs/heads/trinity","commit_id":"4d5aa4191412521671f6b944a114389aec4f8a96","is_merged_in_target_branch":true,"change_id":"I25f9d63904c9de912c7b5455426571eab5b1295b","change_number":242567,"patch_set_number":2,"change_status":"MERGED"}],"branch":"refs/heads/trinity"},"6bd33a4b5c16134e4566a4bd00cea7c9cf4a3518":{"kind":"REWORK","_number":2,"created":"2026-04-10 04:25:42.000000000","uploader":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"ref":"refs/changes/81/242881/2","fetch":{"anonymous http":{"url":"https://review.couchbase.org/query-ui","ref":"refs/changes/81/242881/2","commands":{"Branch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/2 \u0026\u0026 git checkout -b change-242881 FETCH_HEAD","Checkout":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.couchbase.org/query-ui refs/changes/81/242881/2","Reset To":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"4d5aa4191412521671f6b944a114389aec4f8a96","subject":"MB-71194 - Fix location and size of query plan tool tips"}],"author":{"name":"ebenhaber","email":"eben@couchbase.com","date":"2026-04-06 22:34:00.000000000","tz":-420},"committer":{"name":"ebenhaber","email":"eben@couchbase.com","date":"2026-04-10 04:25:27.000000000","tz":-420},"subject":"MB-71725 - better permissions handling in the document editor","message":"MB-71725 - better permissions handling in the document editor\n\nThis issue came out of CBSE-22470, where a customer noted problems\nwith a user who lacked `collections!read` permission on some buckets,\nbut had the permission for other buckets. The bucket/scope/collection\nmenu in the documents page would allow the user to select both\npermitted and non-permitted buckets, but no scopes/collections were\nshown for the non-permitted buckets.\n\nThe user in question had permissions for Query System Catalog, but the\nUI was trying to use the non-permitted `/pools/default` endpoint to\nretrieve the list of scopes and collections for the bucket.\n\nThe UI would default to the `pools/default` endpoint if the user had\n\u0027cluster.collection[.:.:.].collections!read\u0027 permissions, which means\nthe right to list scopes/collections for at least one bucket. But that\ndoesn\u0027t mean that they have the right to list scopes/collections for\n*every* bucket.\n\nThe code has been unchanged for the past 4 years, and this is the\nfirst time a customer has run into the problem. However, it looks like\nthe use of permissions in the document editor was never really correct\nafter the addition of collections in release 7.0.\n\nProblem 1: there are two separate APIs to list scopes/collections,\nwhich require *different* permissions. The `/pools/default/buckets`\nendpoint requires \u0027cluster.collection[bucket:.:.].collections!read\u0027\npermission. However, the same information can be retrieved from the\nquery service if the user has the \u0027Query System Catalog\u0027 role. A user\nmight have one of those permissions but not both, thus the code must\ncheck and use the appropriate endpoint.\n\nProblem 2: there are two separate APIs for retrieving documents. A\nuser with only \u0027data.docs!read\u0027 permission can\u0027t use the query\nendpoint, but a user with \u0027n1ql.select!execute\u0027 can use either the\nquery endpoint or \u0027/pools/default/buckets\u0027. And of course these\npermissions are independent of those described in Problem 1.\n\nProblem 3: to determine whether to permit document editing, the UI was\nonly checking bucket-level permissions, and not collection-level\npermissions. Thus it might allow the user to try and edit a document\nin a read-only collection if there was some other collection in the\nbucket that is writeable. The back-end would prevent the edit, but\nthat doesn\u0027t look good.\n\nSolution 1: Retrieve the \u0027collections!read\u0027 permission for every\nbucket when the document editor is initialized. The code was already\nretrieving whether the user has Query Sytem Catalog, so now the code\ncan determine if the user has permission to fetch scope/collections,\nand if so which of the two APIs to use.\n\nSolution 2: Whenever a collection is selected in the document editor,\nif needed fetch the permissions for that specific collection\nw.r.t. \u0027docs!read\u0027, \u0027docs!upsert\u0027, \u0027docs!delete\u0027, and\n\u0027n1ql.select!execute\u0027. With this information the code knows which APIs\nare available for fetching documents, and whether the documents are\nread-only, read-write, or write-only. (Yes, it is actually possible to\ncreate documents in a collection where the user doesn\u0027t have read\naccess!)\n\nChange-Id: Ie495af092f4330b7388060b265251e4a14f58db2\n"},"parents_data":[{"branch_name":"refs/heads/trinity","commit_id":"4d5aa4191412521671f6b944a114389aec4f8a96","is_merged_in_target_branch":true,"change_id":"I25f9d63904c9de912c7b5455426571eab5b1295b","change_number":242567,"patch_set_number":2,"change_status":"MERGED"}],"branch":"refs/heads/trinity"},"cd054f545a93ad60b0bea570c64bcd8130f68fd6":{"kind":"NO_CODE_CHANGE","_number":3,"created":"2026-04-13 19:48:47.000000000","uploader":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"ref":"refs/changes/81/242881/3","fetch":{"anonymous http":{"url":"https://review.couchbase.org/query-ui","ref":"refs/changes/81/242881/3","commands":{"Branch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/3 \u0026\u0026 git checkout -b change-242881 FETCH_HEAD","Checkout":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.couchbase.org/query-ui refs/changes/81/242881/3","Reset To":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"4d5aa4191412521671f6b944a114389aec4f8a96","subject":"MB-71194 - Fix location and size of query plan tool tips"}],"author":{"name":"ebenhaber","email":"eben@couchbase.com","date":"2026-04-06 22:34:00.000000000","tz":-420},"committer":{"name":"Eben Haber","email":"eben@couchbase.com","date":"2026-04-13 19:48:47.000000000","tz":0},"subject":"MB-71275 - better permissions handling in the document editor","message":"MB-71275 - better permissions handling in the document editor\n\nThis issue came out of CBSE-22470, where a customer noted problems\nwith a user who lacked `collections!read` permission on some buckets,\nbut had the permission for other buckets. The bucket/scope/collection\nmenu in the documents page would allow the user to select both\npermitted and non-permitted buckets, but no scopes/collections were\nshown for the non-permitted buckets.\n\nThe user in question had permissions for Query System Catalog, but the\nUI was trying to use the non-permitted `/pools/default` endpoint to\nretrieve the list of scopes and collections for the bucket.\n\nThe UI would default to the `pools/default` endpoint if the user had\n\u0027cluster.collection[.:.:.].collections!read\u0027 permissions, which means\nthe right to list scopes/collections for at least one bucket. But that\ndoesn\u0027t mean that they have the right to list scopes/collections for\n*every* bucket.\n\nThe code has been unchanged for the past 4 years, and this is the\nfirst time a customer has run into the problem. However, it looks like\nthe use of permissions in the document editor was never really correct\nafter the addition of collections in release 7.0.\n\nProblem 1: there are two separate APIs to list scopes/collections,\nwhich require *different* permissions. The `/pools/default/buckets`\nendpoint requires \u0027cluster.collection[bucket:.:.].collections!read\u0027\npermission. However, the same information can be retrieved from the\nquery service if the user has the \u0027Query System Catalog\u0027 role. A user\nmight have one of those permissions but not both, thus the code must\ncheck and use the appropriate endpoint.\n\nProblem 2: there are two separate APIs for retrieving documents. A\nuser with only \u0027data.docs!read\u0027 permission can\u0027t use the query\nendpoint, but a user with \u0027n1ql.select!execute\u0027 can use either the\nquery endpoint or \u0027/pools/default/buckets\u0027. And of course these\npermissions are independent of those described in Problem 1.\n\nProblem 3: to determine whether to permit document editing, the UI was\nonly checking bucket-level permissions, and not collection-level\npermissions. Thus it might allow the user to try and edit a document\nin a read-only collection if there was some other collection in the\nbucket that is writeable. The back-end would prevent the edit, but\nthat doesn\u0027t look good.\n\nSolution 1: Retrieve the \u0027collections!read\u0027 permission for every\nbucket when the document editor is initialized. The code was already\nretrieving whether the user has Query Sytem Catalog, so now the code\ncan determine if the user has permission to fetch scope/collections,\nand if so which of the two APIs to use.\n\nSolution 2: Whenever a collection is selected in the document editor,\nif needed fetch the permissions for that specific collection\nw.r.t. \u0027docs!read\u0027, \u0027docs!upsert\u0027, \u0027docs!delete\u0027, and\n\u0027n1ql.select!execute\u0027. With this information the code knows which APIs\nare available for fetching documents, and whether the documents are\nread-only, read-write, or write-only. (Yes, it is actually possible to\ncreate documents in a collection where the user doesn\u0027t have read\naccess!)\n\nChange-Id: Ie495af092f4330b7388060b265251e4a14f58db2\n"},"parents_data":[{"branch_name":"refs/heads/trinity","commit_id":"4d5aa4191412521671f6b944a114389aec4f8a96","is_merged_in_target_branch":true,"change_id":"I25f9d63904c9de912c7b5455426571eab5b1295b","change_number":242567,"patch_set_number":2,"change_status":"MERGED"}],"branch":"refs/heads/trinity","description":"Edit commit message"},"dcb5f79bdfc8ec20253267bdfdfe4761fc8f47f4":{"kind":"NO_CODE_CHANGE","_number":4,"created":"2026-04-13 21:18:50.000000000","uploader":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]},"ref":"refs/changes/81/242881/4","fetch":{"anonymous http":{"url":"https://review.couchbase.org/query-ui","ref":"refs/changes/81/242881/4","commands":{"Branch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/4 \u0026\u0026 git checkout -b change-242881 FETCH_HEAD","Checkout":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.couchbase.org/query-ui refs/changes/81/242881/4","Reset To":"git fetch https://review.couchbase.org/query-ui refs/changes/81/242881/4 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"4d5aa4191412521671f6b944a114389aec4f8a96","subject":"MB-71194 - Fix location and size of query plan tool tips"}],"author":{"name":"ebenhaber","email":"eben@couchbase.com","date":"2026-04-06 22:34:00.000000000","tz":-420},"committer":{"name":"Eben Haber","email":"eben@couchbase.com","date":"2026-04-13 21:18:50.000000000","tz":0},"subject":"MB-71275 - better permissions handling in the document editor","message":"MB-71275 - better permissions handling in the document editor\n\nThis issue came out of CBSE-22470, where a customer noted problems\nwith a user who lacked `collections!read` permission on some buckets,\nbut had the permission for other buckets. The bucket/scope/collection\nmenu in the documents page would allow the user to select both\npermitted and non-permitted buckets, but no scopes/collections were\nshown for the non-permitted buckets.\n\nThe user in question had permissions for Query System Catalog, but the\nUI was trying to use the non-permitted `/pools/default` endpoint to\nretrieve the list of scopes and collections for the bucket.\n\nThe UI would default to the `pools/default` endpoint if the user had\n\u0027cluster.collection[.:.:.].collections!read\u0027 permissions, which means\nthe right to list scopes/collections for at least one bucket. But that\ndoesn\u0027t mean that they have the right to list scopes/collections for\n*every* bucket.\n\nThe code has been unchanged for the past 4 years, and this is the\nfirst time a customer has run into the problem. However, it looks like\nthe use of permissions in the document editor was never really correct\nafter the addition of collections in release 7.0.\n\nProblem 1: there are two separate APIs to list scopes/collections,\nwhich require *different* permissions. The `/pools/default/buckets`\nendpoint requires \u0027cluster.collection[bucket:.:.].collections!read\u0027\npermission. However, the same information can be retrieved from the\nquery service if the user has the \u0027Query System Catalog\u0027 role. A user\nmight have one of those permissions but not both, thus the code must\ncheck and use the appropriate endpoint.\n\nProblem 2: there are two separate APIs for retrieving documents. A\nuser with only \u0027data.docs!read\u0027 permission can\u0027t use the query\nendpoint, but a user with \u0027n1ql.select!execute\u0027 can use either the\nquery endpoint or \u0027/pools/default/buckets\u0027. And of course these\npermissions are independent of those described in Problem 1.\n\nProblem 3: to determine whether to permit document editing, the UI was\nonly checking bucket-level permissions, and not collection-level\npermissions. Thus it might allow the user to try and edit a document\nin a read-only collection if there was some other collection in the\nbucket that is writeable. The back-end would prevent the edit, but\nthat doesn\u0027t look good.\n\nSolution 1: Retrieve the \u0027collections!read\u0027 permission for every\nbucket when the document editor is initialized. The code was already\nretrieving whether the user has Query Sytem Catalog, so now the code\ncan determine if the user has permission to fetch scope/collections,\nand if so which of the two APIs to use.\n\nSolution 2: Whenever a collection is selected in the document editor,\nif needed fetch the permissions for that specific collection\nw.r.t. \u0027docs!read\u0027, \u0027docs!upsert\u0027, \u0027docs!delete\u0027, and\n\u0027n1ql.select!execute\u0027. With this information the code knows which APIs\nare available for fetching documents, and whether the documents are\nread-only, read-write, or write-only. (Yes, it is actually possible to\ncreate documents in a collection where the user doesn\u0027t have read\naccess!)\n\nChange-Id: Ie495af092f4330b7388060b265251e4a14f58db2\nReviewed-on: https://review.couchbase.org/c/query-ui/+/242881\nReviewed-by: Piotr Najda  \u003cpiotr.najda@couchbase.com\u003e\nTested-by: Eben Haber \u003ceben@couchbase.com\u003e\nWell-Formed: Restriction Checker\n"},"parents_data":[{"branch_name":"refs/heads/trinity","commit_id":"4d5aa4191412521671f6b944a114389aec4f8a96","is_merged_in_target_branch":true,"change_id":"I25f9d63904c9de912c7b5455426571eab5b1295b","change_number":242567,"patch_set_number":2,"change_status":"MERGED"}],"branch":"refs/heads/trinity"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"OK","applied_by":{"_account_id":1002967,"name":"Eben Haber","email":"eben@couchbase.com","username":"eben","avatars":[{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/92670d3eb689624a33ac6c2860cd609c.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}},{"label":"Code-Review","status":"OK","applied_by":{"_account_id":1005387,"name":"Piotr Najda ","email":"piotr.najda@couchbase.com","username":"piotrnajda3000","avatars":[{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/f00c8cdf07ae5b606df820e7a18a278e.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}]}},{"label":"Well-Formed","status":"MAY","applied_by":{"_account_id":1004139,"name":"Restriction Checker","username":"ns-codereview","avatars":[{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d32","height":32},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d56","height":56},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d100","height":100},{"url":"https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?d\u003didenticon\u0026r\u003dpg\u0026s\u003d120","height":120}],"tags":["SERVICE_USER"]}}]}],"submit_requirements":[{"name":"Verified","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Verified\u003dMAX -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX","-label:Verified\u003dMIN"],"failing_atoms":[]}},{"name":"Code-Review","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX","-label:Code-Review\u003dMIN"],"failing_atoms":[]}}]}