metabase / metabase/metabase

"Corrupted" permissions aren't showing correctly on the FE

Open
#23,816 2 comments 0 reactions 0 assignees View on GitHub
.Frontend .Team/UXWest Administration/Permissions Misc/API Priority:P3 Type:Bug
Dominant language
Clojure
Stars
49.3k
Forks
6.8k
Avg merge
1d 13h
Merged PRs (30d)
653

Description

**Describe the bug**
A weird case where, if you change the permissions graph via the API, then the FE doesn't show the values correctly.

**Logs**
NA

**To Reproduce**
On a brand new Metabase:
1) go to /admin/permissions/data/group
2) click on "All users" to see the permissions that the group has. Default should be:
![image](https://user-images.githubusercontent.com/1711649/178077427-cfc77ddd-6c3e-4737-8f3a-ead329ba34ca.png)
3) Now Block data access to "All users", so you will have the permissions like:
![image](https://user-images.githubusercontent.com/1711649/178077521-a7a96692-9c06-4006-877d-9bf8f7e7065c.png)
4) Now go to /admin/people/groups and create a new group, then go back to permissions and block the data access to this new group
5) Now using the tool you like to a PUT request to /api/permissions/graph, with the following payload
{"groups":{"1":{"3":{"download": {"native": "full", "schemas": "full"}, "data": {"schemas": "block"}}},"2":{"3":{"data":{"native":"write","schemas":"all"},"download":{"native":"full","schemas":"full"},"data-model":{"schemas":"all"},"details":"yes"}},"3":{"3":{"data":{"native":"none","schemas":"block"}}}},"revision":2}
6) Now refresh the page, you'll see that the page has an alert that the All users group is more permissive, but according to the UI, it isn't:
![image](https://user-images.githubusercontent.com/1711649/178078044-ab6f4178-4546-4db7-b676-619bc953b5d4.png)

![image](https://user-images.githubusercontent.com/1711649/178078062-057d89e2-434b-4aec-b323-9bd5132852aa.png)

**Expected behavior**
Show the correct message on the FE (Download results: YES)

**Screenshots**
Above

**Information about your Metabase Installation:**
- Your browser and the version: Brave latest
- Your operating system: Pop-OS 22.04
- Your databases: H2
- Metabase version: 1.43.4
- Metabase hosting environment: Docker
- Metabase internal database: Postgres 14.2

**Severity**
Cosmetic

**Additional context**
Workaround: set the group to another data permission, and then revert back, so the frontend does the correct API requests to remove the permissions

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue from /admin/permissions/data/group using the PUT /api/permissions/graph payload in the report, then trace how the permissions graph is rendered in the frontend. Done means the UI shows the correct alert and “Download results: YES” after the API changes, including the supplied reproduction sequence.

Written by the indexing model from the issue text.

Assessment

Tech stack
clojure
Domain
authorization, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.