anmot.Original post
Rank 2: Process
A function is created with no execution access (please refer the screenshot)
When invoking the function from client SDK, it returns user not authorized as expected
AppwriteException: user_unauthorized, No permissions provided for action 'execute' (401)
When invoking the function via REST API, it ignores the permissions and invokes the function
curl --location 'https://<masked>.appwrite.global/' \
--header 'Content-Type: application/json' \
--data '{}'
{"code":500,"type":"InternalServerError","message":"Internal Server Error"}
Summary
Execution permissions were not being honored when invoking a cloud function via REST API, even though permissions were set. The issue was fixed in version 1.5.x.