Permission denied for action create on class <...>

Technical Issue Reporting
#1

After setting up CLP on class Article like the following:

image
image1008×465 35.3 KB

here is how it looks like when I hit the schema endpoint:

{
    "className": "Article",
    "fields": {
        "objectId": {
            "type": "String"
        },
        "createdAt": {
            "type": "Date"
        },
        "updatedAt": {
            "type": "Date"
        },
        "ACL": {
            "type": "ACL"
        },
        "title": {
            "type": "String"
        },
        "url": {
            "type": "String"
        },
        "votes": {
            "type": "Array"
        },
        "submittedBy": {
            "type": "Pointer",
            "targetClass": "_User"
        }
    },
    "classLevelPermissions": {
        "find": {
            "*": true
        },
        "count": {
            "*": true
        },
        "get": {
            "*": true
        },
        "create": {
            "role:Contributor": true
        },
        "update": {},
        "delete": {},
        "addField": {},
        "protectedFields": {}
    },
    "indexes": {
        "_id_": {
            "_id": 1
        }
    }
}

I am getting Permission denied for action create on class Article. error while trying to create a new object in that class with the user who has the Contributor role.

I am not sure what I am doing wrong?

#2

if you set more permissions then it starts to work at some point?

#3

I have added all permission to the role and still getting the same error.

image
image1030×485 36.9 KB

#4

you can try to add more permissions on the above lines too

#5

If I add the Create permission on Public row it works.

If i add the Create permission on the Authenticated row i get the following error:
Permission denied, user needs to be authenticated.
which is very strange as the user is authenticated actually.

image
image1022×468 36.7 KB

?

#6

Actually, I think this problem is on my side.

I am actually not saving objects directly from the frontend but trough a cloud function instead. That is why CLP is failing.

How can I check if the user has a certain role in the cloud function? If i run
role.getUsers() on a particular role i get the following

{
  "__type": "Relation",
  "className": "_User"
}

What I really want is to get a list of users in that relation. How do I do that?

#7

your question sounds similar to this answer: Add more integration of User Roles to the api

1 Like
#8

Thanks a lot.

So instead of querying if the user is in the role, i should query just what is the role of the user.

However, in the cloud function Is it possible to somehow pass the request object to the save method in order not to have to validate the roles in the cloud functions directly?

Do you know what I mean?

#9

it looks like you could try to add a role validation for a specific cloud function
#10

This is exactly what I am looking for but just tried it and it doesn’t seem to work.

It seems its a recent parse feature. Do you know which version is Moralis using under the hood?

#11

Looks like its only released some days ago

image
image2254×270 32.6 KB

#12

I don’t know the exact version of Parse that Moralis is using, but I know that it is not Parse 5, it is a version of Parse 4

1 Like