UsersDatabasesWeb

Users cannot update documents with document-level permission

Dec 27, 2023, 20:31

View on Discord

Votes

Replies

Participants

Unknown

Messages

42TomOriginal post

Rank 2: Process

Jul 2, 2023, 21:36

Yes

Summary

Users are unable to update documents with document-level permission. The issue seems to persist even after a migration. The user attempted to migrate from version 1.3.4 to 1.3.7, but encountered an error. They have checked all related collections and confirmed that the update permission is granted. Another user tried to reproduce the issue but was successful in updating the document. The collections involved in the relationship have document security enabled and only allow the "create" permission for users. One potential solution suggested is to create a function with full API permission to handle the update and check for the correct user permission within the function. However,

Drake

Jul 2, 2023, 21:36

What access does the user have on the related collection?

42Tom

Rank 2: Process

Jul 2, 2023, 21:37

I think it's where the error is coming from, because the only collection without a relationship inside is working

42Tom

Rank 2: Process

Jul 2, 2023, 21:37

Same one, can create in the collection, can read and update individual documents

Drake

Jul 2, 2023, 21:40

So the related document...what are the permissions on the related document?

42Tom

Rank 2: Process

Jul 2, 2023, 21:42

Same one as the parent document, the user is able to read and update

42Tom

Rank 2: Process

Jul 2, 2023, 21:48

To make sure my setup is clear:

I have 2 collections: A and B.
A has a two-way relationship attribute with B.

Both A and B have document security enabled, both have only the create permission for users.

There are 2 documents, document 1 in A, document 2 in B.
There is a two-way relationship of document 1 to document 2.

Both document 1 and document 2 has read and update permissions for the user.
When the user edits one string attribute of document 1, it yields a 401.
When the user edits one string attribute of document 2, it yields a 401 as well.
When the user edits one string attribute of a third collection with no relationship but with the same permissions (document security, create on the collection, read and update for the user on the document), it works.

Vedsaga

Rank 5: Hypervisor

Jul 8, 2023, 08:02

@42Tom did you found the solution?

Vedsaga

Rank 5: Hypervisor

Jul 8, 2023, 08:02

seems I am facing the same issue... it looks like I need to grant update access to all the related Document...

Vedsaga

Rank 5: Hypervisor

Jul 8, 2023, 08:10

umm, it seems this also doesn't fixes it

42Tom

Rank 2: Process

Jul 8, 2023, 13:12

Hi, unfortunately no
I think this is a bug in Appwrite but I haven't had the time to debug it

A quick and dirty solution is to create a function with full API permission that will do the update
And you check inside the function that the user has the correct permission

42Tom

Rank 2: Process

Jul 8, 2023, 13:13

Vedsaga

Rank 5: Hypervisor

Jul 8, 2023, 13:14

oh thank you for confirming

Drake

Jul 8, 2023, 16:44

We'll need to try and reproduce this. What type of relationship do you have?

42Tom

Rank 2: Process

Jul 8, 2023, 17:33

It's a two-way "one to many" relationship from collection A towards collection B.
I encourage you to check the code I sent earlier in the discussion, because it seems in this particular case Appwrite fails to identify that the document rule applies (it throws the error in a if code where it checks for !$documentSecurity while both of the collections have document-security enabled).

Drake

Jul 8, 2023, 22:18

so i just tried to reproduce this, but it works fine for me.

Collection A:

JSON

{
    "$id": "level1",
    "$createdAt": "2023-07-06T20:48:10.666+00:00",
    "$updatedAt": "2023-07-08T22:14:20.553+00:00",
    "$permissions": [
        "create(\"any\")"
    ],
    "databaseId": "one-to-many",
    "name": "Level 1",
    "enabled": true,
    "documentSecurity": true,
    "attributes": [
        {
            "key": "level2",
            "type": "relationship",
            "status": "available",
            "required": false,
            "array": false,
            "relatedCollection": "level2",
            "relationType": "oneToMany",
            "twoWay": true,
            "twoWayKey": "level1",
            "onDelete": "restrict",
            "side": "parent"
        },
        {
            "key": "s",
            "type": "string",
            "status": "available",
            "required": false,
            "array": false,
            "size": 10,
            "default": null
        }
    ],
    "indexes": []
}

Collection B:

JSON

{
    "$id": "level2",
    "$createdAt": "2023-07-06T20:48:11.025+00:00",
    "$updatedAt": "2023-07-08T22:14:29.193+00:00",
    "$permissions": [
        "create(\"any\")"
    ],
    "databaseId": "one-to-many",
    "name": "Level 2",
    "enabled": true,
    "documentSecurity": true,
    "attributes": [
        {
            "key": "level1",
            "type": "relationship",
            "status": "available",
            "required": false,
            "array": false,
            "relatedCollection": "level2",
            "relationType": "oneToMany",
            "twoWay": true,
            "twoWayKey": "level1",
            "onDelete": "restrict",
            "side": "parent"
        }
    ],
    "indexes": []
}

Drake

Jul 8, 2023, 22:18

Here's my document in level1:

JSON

{
    "s": "asdf",
    "$id": "level1",
    "$createdAt": "2023-07-06T20:49:25.373+00:00",
    "$updatedAt": "2023-07-08T22:16:22.731+00:00",
    "$permissions": [
        "read(\"user:joe\")",
        "update(\"user:joe\")"
    ],
    "level2": [
        {
            "$id": "level2",
            "$createdAt": "2023-07-06T20:49:25.373+00:00",
            "$updatedAt": "2023-07-08T22:16:22.734+00:00",
            "$permissions": [
                "read(\"user:joe\")",
                "update(\"user:joe\")"
            ],
            "$databaseId": "one-to-many",
            "$collectionId": "level2"
        }
    ],
    "$databaseId": "one-to-many",
    "$collectionId": "level1"
}

Drake

Jul 8, 2023, 22:19

update:

JavaScript

res = await fetch("https://8080-appwrite-integrationfor-sph1lsdai8a.ws-us101.gitpod.io/v1/databases/one-to-many/collections/level1/documents/level1", {
  "headers": headers,
  "referrer": "http://localhost:3000/",
  "referrerPolicy": "strict-origin-when-cross-origin",
  "body": JSON.stringify({data: {s: "as"}}),
  "method": "PATCH",
  "mode": "cors",
  "credentials": "omit"
});
await res.json()

Drake

Jul 8, 2023, 22:20

response:

JSON

{
    "s": "as",
    "$id": "level1",
    "$createdAt": "2023-07-06T20:49:25.373+00:00",
    "$updatedAt": "2023-07-08T22:19:59.848+00:00",
    "$permissions": [
        "read(\"user:joe\")",
        "update(\"user:joe\")"
    ],
    "level2": [
        {
            "$id": "level2",
            "$createdAt": "2023-07-06T20:49:25.373+00:00",
            "$updatedAt": "2023-07-08T22:19:59.851+00:00",
            "$permissions": [
                "read(\"user:joe\")",
                "update(\"user:joe\")"
            ],
            "$databaseId": "one-to-many",
            "$collectionId": "level2"
        }
    ],
    "$databaseId": "one-to-many",
    "$collectionId": "level1"
}

42Tom

Rank 2: Process

Jul 9, 2023, 16:54

The setup seems similar, that's strange.
I'll try spin up a minimal reproductible setup when I'll get some free time.

Vedsaga

Rank 5: Hypervisor

Jul 11, 2023, 16:52

I can share the json schema but it will be very big one like ~30 odd collection. I can confirm that I was able to replicate it or may be I am not sure which collection permission is missing I have checked all related collection and there is update permission garated

Vedsaga

Rank 5: Hypervisor

Jul 11, 2023, 16:52

btw I was in version 1.3.4, I just tried to migrate to 1.3.7 and for some reason it's failing...

Drake

Jul 11, 2023, 16:56

Definitely make sure you're on 1.3.7 and you may need to update permissions

Vedsaga

Rank 5: Hypervisor

Jul 11, 2023, 16:57

I just tried to migrate and got this error, I mean for some reaosn it failed https://discord.com/channels/564160730845151244/1128367787690168461

Vedsaga

Rank 5: Hypervisor

Jul 11, 2023, 17:44

coming to this, I am stil getting same issue it seems, even after migration

Join the discussion

Reply to this thread by joining our Discord.

Reply on Discord

Need support?_

Join Discord Get premium support