Database/collection relationship is forgeable
alevy opened this issue · comments
In the structured branch, accessP will happily accept and run a query on any database regardless of whether the policy was written by that database's owner or not. Database should be a field of Policy rather than a parameter to accessP
As we discussed (writing this solely for record), we can address this by fusing the DB and Collection into a DBCollection which will be used by all primitives.
fixed in 9855469