Rank 2: Process
Am on 1.3.7
Hi, I'm writing this in case this can help someone.
If I define a collection A with a relationship to collection B (1:1).
I set permissions "correctly" on collection A such that team XYZ can update collection A BUT I forgot to set the permission for XYZ to update collection B.
I create an email session and use the X-Fallback-Cookie to update collection A (say a string attribute called Name), I will hit into a "user is not authorized" 401 error. Even if I switch to the Server API, I still get "user is not authorized" and that's when I panicked. However, when I clear the user's session (go to Auth, look for the user and then sessions and then delete all), I can use the Server API to update (successful).
The solution is to update collection B's permission such that team XYZ can also update it.
I appreciate the permission bit but when the document "locks up" such that even using the server API fails to update it is frigging scary.