Permissions for "App Access Minimum" does not allow user to view app

[that1matt]

Describe the Bug

When you set the permissions using the App Access Minimum and try and login as the user, after login you are greeted with an error "No App Access - the user isn't allowed to use the admin app."

To Reproduce

1. Create a new role & user with new role.
2. Use the App Access Minimum link to reset system permissions.
3. Do not change any other permissions.
4. Try and login with new user.
5. Greeted with error message.

Workaround:

1. Changing the directus_users read value from required for app access to all access allows user to login and view the app.

Directus Version

10.7.0

Hosting Strategy

Self-Hosted (Docker Image)

[u12206050]

Shouldn't this have been hot-fixed release asap, no other users except admin can use Directus 10.7.0 currently?

[rijkvanzanten]

no other users except admin can use Directus 10.7.0 currently?

That's not true, it's permissions based so it depends on your configuration. Only you're using a role with app access enabled with all other default permissions reduced to the minimum, you'll run into this issue

[u12206050]

Works on 10.7.1 now. Thanks.

[arladmin]

no other users except admin can use Directus 10.7.0 currently?

That's not true, it's permissions based so it depends on your configuration. Only you're using a role with app access enabled with all other default permissions reduced to the minimum, you'll run into this issue

I just ran into the same issue.

I usually go for 'minimum app access' permission for the system collections, for most of the roles.

[arladmin]

Shouldn't this have been hot-fixed release asap, no other users except admin can use Directus 10.7.0 currently?

I completely second this.

This IS a valid (and extremely prevalent for us) use-case within the context of the app.

[paescuj]

I just ran into the same issue.

With 10.7.1?

[arladmin]

I just ran into the same issue.

With 10.7.1?

Nope, with 10.7.0

Ended up waiting for 10.7.1's release and then for the hosting platform (Cloudron) to package and release the updated version.

[arladmin]

@paescuj @rijkvanzanten

Update: Even with v10.7.1, the problem's still there!

And rolling back to v10.6.4 doesn't solve the issue either.

Now multiple apps running in production are down 😱

[arladmin]

Finally, the workaround seems to be to reapply the "App Access Minimum" by first setting changing the permissions to "recommended Defaults" and then back to "App Access Minimum".

Note: in this process, any custom permissions applied originally are lost.

[azrikahar]

Finally, the workaround seems to be to reapply the "App Access Minimum" by first setting changing the permissions to "recommended Defaults" and then back to "App Access Minimum".

I believe the reason why updating didn't work earlier was due to the cache still being the old/invalid permissions. The reason the stated workaround worked is because modifying the permissions subsequently cleared the corresponding cache along the way.

Tested the following steps as a confirmation:

1. Started 10.7.0 with Redis cache.
2. Attempt to login as a user with a role with minimum permission, gets No App Access error.
3. Upgrade to 10.7.1.
4. Attempt to login as the same user again, gets the same No App Access error.
5. Used an admin token to clear the cache via /utils/cache/clear endpoint.
6. Once again attempt to login as the same user, now it works (without having to reapply any permissions).