Getting 403 for some rows in a table

[sjugraj]

Describe the Bug

We have table-created articles that have a list of items.

We are using Docker version 9.7.0 of the Directus, which is running fine on the table.

We were facing a bug upgrading to the latest version of the docker.

We first saw the issue in the 9.15.0 version, and we postpone the upgrade, we tried the 9.21.1, 9.22.0, and 9.22.4 versions, also all had the same issue.

The bug is as follows.

We can open the edit interface for some rows without the problem while some rows are throwing the below error

We have checked the logs, and the error is provided below. there is no additional information on what can be the problem, just the error below.

and the error is not uniform across all tables and only 4 out of 10 items we checked randomly.

To Reproduce

To reproduce this error we can create a table with 9.7.0 and then upgrade to any of the mentioned versions.

Errors Shown

[12:07:03] GET /items/articles/164c44c7-57ad-d5fe-fade-26b6d6204b6c 403 15ms
[12:07:03.857] DEBUG: You don't have permission to access this.
err: {
"type": "ForbiddenException",
"message": "You don't have permission to access this.",
"stack":
Error: You don't have permission to access this.
at validateKeys (/directus/node_modules/directus/dist/utils/validate-keys.js:21:19)
at ItemsService.readOne (/directus/node_modules/directus/dist/services/items.js:302:42)
at /directus/node_modules/directus/dist/controllers/items.js:88:34
at /directus/node_modules/directus/dist/utils/async-handler.js:3:66
at Layer.handle [as handle_request] (/directus/node_modules/express/lib/router/layer.js:95:5)
at next (/directus/node_modules/express/lib/router/route.js:144:13)
at /directus/node_modules/directus/dist/middleware/collection-exists.js:28:12
at /directus/node_modules/directus/dist/utils/async-handler.js:3:66
at Layer.handle [as handle_request] (/directus/node_modules/express/lib/router/layer.js:95:5)
at next (/directus/node_modules/express/lib/router/route.js:144:13)
"status": 403,
"code": "FORBIDDEN",
"extensions": {}
}
[12:07:04] GET /server/info 200 18ms

What version of Directus are you using?

9.7.0

What version of Node.js are you using?

Docker version 9.7.0

What database are you using?

postgres 14

What browser are you using?

Chrome

How are you deploying Directus?

Docker

[sjugraj]

I was able to investigate the issue

The issue is in /directus/api/src/utils/validate-keys.ts

I have added some console.log statements

const primaryKeyFieldType = schema.collections[collection]?.fields[keyField]?.type;
console.log("primaryKeyFieldType", primaryKeyFieldType)
console.log("keys", keys)
console.log("validateUUID", validateUUID(String(keys)))
if (primaryKeyFieldType === 'uuid' && !validateUUID(String(keys))) {
	console.log("Inside first IF")
	throw new ForbiddenError();
} else if (primaryKeyFieldType === 'integer' && !Number.isInteger(Number(keys))) {
	throw new ForbiddenError();
}

Here is the output of that logs
This one works from the same Table

primaryKeyFieldType uuid
keys 4f3bd1ce-3995-4971-a6a1-8aae095c2cb3
validateUUID true

This one from the same table not works and throws ForbiddenError

primaryKeyFieldType uuid
keys 47074e45-da5d-d3b7-a71c-bd0815a7f66b
validateUUID false
Inside first IF

My confusion is the docker from 9.7.0 don't have this issue while the latest docker 10.4.0 has this issue

I have checked with UUID Validator
It says The UUID - 47074e45-da5d-d3b7-a71c-bd0815a7f66b is valid and its version is 13

[sjugraj]

@rijkvanzanten I am unsure how to resolve the issue as my table has over 100,000 records and multiple affected rows.

[rijkvanzanten]

Can you reproduce the issue on an empty installation with a single item?