Back
401 user_unauthorized on TablesDB update despite table‑level label:admin update + row security enab
Hi Appwrite team, We’re hitting a permissions issue with TablesDB updates. Setup
- Appwrite Cloud, JS SDK
- TablesDB (new tables)
- Row security enabled (Console shows: “users can access rows if they have either row or table permissions”)
- Table permissions for products and prompts: label:admin has Create/Read/Update
- Row permissions on rows: team‑only (no label:admin)
- Admin user is not a team member, but does have label admin
Expected
Since row security is ON and table permissions grant
label:adminupdate, admin user should be able to update any row (even without row‑level permission). Actual Update fails with 401 when calling TablesDB update/upsert from the client:PUT /v1/tablesdb/dev/tables/products/rows/<rowId>Payload: { data: { name, description } } Error:{ code: 401, type: "user_unauthorized", message: "Permissions must be one of: (...label:admin)" }Notes - Reads work (same client SDK)
- Creates/deletes work via backend API (admin SDK)
- Updates are client‑side TablesDB calls
- Appwrite error version: 1.8.1 (from response) Questions
- With row security ON, should table‑level label:admin update permission allow updates without row‑level permission?
- Is there a known issue with label roles + row security for updates?
- Do we need to add label:admin to every row’s update permission even when table permission already grants it?
TL;DR
Developers are encountering a 401 user_unauthorized error when attempting to update TablesDB rows, despite having admin level permissions at the table level and row security enabled. Upgrades are failing when calling the TablesDB update/upsert function from the client. The issue may be due to requiring label:admin permission at the row level, even if it is already granted at the table level. The questions are about the interaction of label roles and row security in updates.
1) The table-level label:admin update permission does not automatically grant update access at the row level when row security is ON.
2) There may be an issue with label