Error `(role: applications) missing scope (rules.read)` when deploying self-hosted functions

When deploying functions like this:

TypeScript

appwrite client --endpoint mydomain.com --project-id some-id --key some_key
appwrite push functions --all --force --verbose

I get this output:

TypeScript

✓ Success: Setting client
ℹ Info: Validating functions ...
ℹ Info: Checking for changes ...
ℹ Info: Pushing functions ...
⠴ Pushing      • api-handler (api_handler)                • Ignoring using: .gitignore
⠼ Creating     • user-created-handler (user_created_handler) • Ignoring using: .gitignore
⠼ Pushing      • app-config-handler (app_config_handler)  • Ignoring using: .gitignore(node:94912) ExperimentalWarning: buffer.File is an experimental✗ Error        • api-handler (api_handler)                • app.projectId@service.mydomain.
✗ Error        • user-created-handler (user_created_handler) • app.projectId@service.mydomain
✗ Error        • app-config-handler (app_config_handler)  • app.projectId@service.mydomain
✓ Success: Successfully pushed 3 functions.
AppwriteException [Error]: app.projectId@service.mydomain.com (role: applications) missing scope (rules.read)
    at Client.call (/home/asd/.nvm/versions/node/v18.18.2/lib/node_modules/appwrite-cli/lib/client.js:211:13)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async proxyListRules (/home/asd/.nvm/versions/node/v18.18.2/lib/node_modules/appwrite-cli/lib/commands/proxy.js:68:16)
    at async /home/asd/.nvm/versions/node/v18.18.2/lib/node_modules/appwrite-cli/lib/commands/push.js:1235:37
    at async Promise.all (index 0)
    at async pushFunction (/home/asd/.nvm/versions/node/v18.18.2/lib/node_modules/appwrite-cli/lib/commands/push.js:1072:5) {
  code: 401,
  response: 'general_unauthorized_scope'
}

The API key i'm using for the CLI has all scopes enabled. Neither online nor in the Discord here i can find anything on a rules.read scope. The functions do get deployed (they show up in the console), but still wondering about this error. Anyone any idea? v1.6, CLI v6.1.0

TL;DR

Users are encountering the error `(role: applications) missing scope (rules.read)` when deploying self-hosted functions. One user suggests a temporary fix by manually adding the missing scope using a fetch request through the console. The issue is acknowledged by the team, and there is ongoing work on reworking the endpoints. For now, users are advised to utilize Console or Appwrite CLI to set up rules.CLI version 1.9.1 should have the functionality to create rules, and a workaround is provided to edit API keys with the missing scope.

Hey, I am seeing the same thing. Everything appears to work fine still, but things seeming to work with an error which you can't explain doesn't sit well with me, so I would rather solve it...

What are we doing wrong here?

Same trying to push from an API KEY for CI

the push works but it cannot process a proxy endpoint : https://github.com/appwrite/sdk-for-cli/blob/master/lib/commands/push.js#L1609C43-L1609C57 at the end of the process

oh maybe it's just a console issue, the scope exists in the docs but are not shown in the API KEY Scopes view

for a small fix you can :

open the dev tools
add and remove a random scope
go in the network tab
copy as fetch the put request for the API KEY
paste it in the console tab
add the rules.read in the scope it should look something like that :

TypeScript

fetch("https://appwrite.example.com/v1/projects/XXX/keys/XXX", {
  "headers": {
    "accept": "*/*",
    "accept-language": "fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
    "cache-control": "no-cache",
    "content-type": "application/json",
    "pragma": "no-cache",
    "priority": "u=1, i",
    "sec-ch-ua": "\"Not)A;Brand\";v=\"8\", \"Chromium\";v=\"138\", \"Microsoft Edge\";v=\"138\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"Linux\"",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "same-origin",
    "x-appwrite-project": "console",
    "x-appwrite-response-format": "1.7.0",
    "x-sdk-language": "web",
    "x-sdk-name": "Console",
    "x-sdk-platform": "console",
    "x-sdk-version": "1.8.0"
  },
  "referrer": "https://appwrite.example.com/console/project-default-XXX/overview/keys/XXX",
  "body": "{\"name\":\"Gitlab CI\",\"scopes\":[\"databases.read\",\"databases.write\",\"collections.read\",\"collections.write\",\"attributes.read\",\"attributes.write\",\"indexes.write\",\"documents.read\",\"documents.write\",\"buckets.write\",\"functions.read\",\"functions.write\",\"targets.write\",\"providers.write\",\"topics.write\",\"sites.write\",\"rules.read\"]}",
  "method": "PUT",
  "mode": "cors",
  "credentials": "include"
});

tho if you edit the scopes again from the console the rules.read will be gone

https://github.com/appwrite/console/issues/2156

No news on the issue =/, still have this issue

I am also waiting for a response on this.

👀 https://github.com/appwrite/console/pull/2972

maybe for 1.9.1 ?

Randomly noticed this support thread; Indeed, we are reworking some endpoints that are currently only used by Console to be up to our quality standard, and available in Server SDK. And yes, Proxy API (rules - ability to link a domain to a resource) is one of things on my todo list 🔥

As of right now, you will need to use Console (in browser) or Appwrite CLI (in terminal) to setup rules. In latest CLI version I believe creating rule should work, and if not, you can ping me or Chirag to look into it

i also provided a "small" fetch above to edit the API keys with the rules.XXX scopes as a workaround if we really need to use an API key (for CI/CD)

But ye console, and CLI (only works with appwrite login email/pass) can indeed deploy functions

Anwesome !!

Reply to this thread by joining our Discord

Reply on Discord

Need support?

Join our Discord

Get community support by joining our Discord server.

Join Discord

Get premium support

Join Appwrite Pro and get email support from our team.

Learn more

Recommended threads

Need support?

Join our Discord

Get premium support