Can update documents without permissions

Hello.

It looks like I am able to update documents without proper permissions.
Using the latest 1.5.7 version.

Would love some help with this.

So far GET does not work, but PATCH does

you mean, with the READ permissions to ANY, GET doesn't work but PATCH does?

so if i do role any -> read, the read works, if i remove it, the read no longer works.

however, if I do any -> update, i can update, but if i remove it, i can still update

cannot reproduce 🤔. I do get an auth error.

you have any keys added to the headers? could be possible in that case... 👀?

I see whats happening...

If you update with the SAME data, currently present in the Document, then it does update and returns the whole doc. If you change the data a bit, it returns with an auth error.

@Steven what do you think?