TL;DR
The formula evaluator queries the underlying DB directly without applying rights checks. Useful for aggregation across rights boundaries; risky if used to project raw data.
Source
entu/api/utils/formula.js (493 lines) contains zero references to rights, _viewer, _owner, _editor, access, authorized, or systemUser. All data fetches go through raw db.collection(...).find() and .aggregate() calls — no rights-filtering wrapper.
Behavior
A formula on entity A traversing to entity B will return data from B even when the caller has no rights to read B directly. The formula result is then stored on A and read by the caller through A's normal rights.
Implication
This is a useful feature for aggregation (counts, sums, averages across rights boundaries — e.g., umbrella org rolling up member counts from child collectives where the umbrella member can't see child rosters directly). It's a footgun if used for raw data projection (e.g., CONCAT_WS of names across orgs would leak names to anyone with read access on the formula-bearing entity).
Threat surface bounded by who can DEFINE formulas (requires _editor on the entity type schema — usually database admins only).
Suggested doc note
At https://www.entu.ee/api/formulas/: add a security note clarifying:
- Formula evaluation bypasses caller-rights filtering
- Safe for aggregates; do not project raw data via formulas across rights boundaries
- Threat surface is bounded by who can define formulas (schema-level rights)
Related: polyphony case study D6 — https://github.com/entu/research/blob/main/docs/case-studies/2026-05-polyphony-on-entu.md
TL;DR
The formula evaluator queries the underlying DB directly without applying rights checks. Useful for aggregation across rights boundaries; risky if used to project raw data.
Source
entu/api/utils/formula.js(493 lines) contains zero references to rights,_viewer,_owner,_editor,access,authorized, orsystemUser. All data fetches go through rawdb.collection(...).find()and.aggregate()calls — no rights-filtering wrapper.Behavior
A formula on entity A traversing to entity B will return data from B even when the caller has no rights to read B directly. The formula result is then stored on A and read by the caller through A's normal rights.
Implication
This is a useful feature for aggregation (counts, sums, averages across rights boundaries — e.g., umbrella org rolling up member counts from child collectives where the umbrella member can't see child rosters directly). It's a footgun if used for raw data projection (e.g.,
CONCAT_WSof names across orgs would leak names to anyone with read access on the formula-bearing entity).Threat surface bounded by who can DEFINE formulas (requires
_editoron the entity type schema — usually database admins only).Suggested doc note
At https://www.entu.ee/api/formulas/: add a security note clarifying:
Related: polyphony case study D6 — https://github.com/entu/research/blob/main/docs/case-studies/2026-05-polyphony-on-entu.md