directus / directus/directus

Deselecting any field in the user read policy will break the user page

Open
#24,063 2 comments 2 reactions 0 assignees View on GitHub
Bug Permissions Studio
Dominant language
TypeScript
Stars
37.9k
Forks
4.9k
Avg merge
3d 21h
Merged PRs (30d)
36

Description

### Describe the Bug

By deselecting any field in the user read policy, I would expect that that selected field hasn't become available and thus the field is hidden for the user with said policy.

However, if I deselect just one field, suddenly all users are gone, (but the count is still correct)

### To Reproduce

1. Create a policy with app access and recommended settings (which provide read access to all users)
2. Assign the policy to a role
3. Create and add a user `A` under this role
4. Create and add a user `B`
5. Login with `A`; you should see user `B`
6. Remove the `token` field from the user read policy
7. As user `A`, you can't see any user now

### Directus Version

v11.1.1

### Hosting Strategy

Self-Hosted (Docker Image)

### Database

PostgreSQL 16

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.