Skip to content

Update relationship_not_setup wording to clarify it may also result from missing permissions#26918

Merged
AlexGaillard merged 4 commits intodirectus:mainfrom
Ikromjon1998:fix/relation-permission-backend
Mar 27, 2026
Merged

Update relationship_not_setup wording to clarify it may also result from missing permissions#26918
AlexGaillard merged 4 commits intodirectus:mainfrom
Ikromjon1998:fix/relation-permission-backend

Conversation

@Ikromjon1998
Copy link
Copy Markdown
Contributor

Summary

When a user lacks read permission on a related collection, the relational interfaces (M2O, O2M, M2M, M2A, Files) showed "The relationship hasn't been configured correctly" — which is misleading since the relationship is correctly configured, the user simply doesn't have access.

This is a follow-up to #26837 with the backend fix requested by reviewers.

What changed

Backend (api/src/services/relations.ts):

  • Modified filterForbidden() to differentiate between two cases:
    1. User can't read the many-side (collection/field owning the relation) → relation is still filtered out completely
    2. User can read the many-side but can't read the related collection → relation is kept but marked with related_collection_readable: false

Types (packages/types/src/relations.ts):

  • Added optional related_collection_readable?: boolean field to the Relation type

Frontend composables:

  • Added relationMissingPermissions computed property to use-relation-m2o.ts, use-relation-o2m.ts, use-relation-m2m.ts, and use-relation-m2a.ts that checks the explicit backend flag
  • relationInfo returns undefined when related_collection_readable === false to prevent downstream errors

Frontend interfaces:

  • Updated 5 relational interface components to show a permission-specific warning when relationMissingPermissions is true

Translation:

  • Added relationship_missing_permissions key to en-US.yaml

Closes #21337

Key design decisions

  • The fix is in filterForbidden() on the backend — the root cause — rather than inferring permission issues from meta.special on the frontend
  • The related_collection_readable field is optional and backwards compatible — existing consumers that don't know about it will just ignore it
  • When undefined, the relation is fully accessible (same behavior as before)

Test plan

  • Unit tests for all 4 relation composables (M2O, O2M, M2M, M2A)
  • User with read permission on main collection but no read permission on related collection sees "You don't have permission to view the related collection"
  • User with a genuinely misconfigured relationship still sees "The relationship hasn't been configured correctly"
  • Admin users are unaffected (full access to all relations)

@ComfortablyCoding
Copy link
Copy Markdown
Member

ComfortablyCoding commented Mar 24, 2026

I understand @robluton stated this should be a backend fix but I believe this will potentially expose information about relationships. I wonder if we can simply fix this by updating the relationship_not_setup translation key to be "The relationship is not configured properly or you don’t have permission to access it.". Thoughts?

Copy link
Copy Markdown
Contributor

@ComfortablyCoding I like your thinking here. Nice and simple.

Copy link
Copy Markdown
Member

@ComfortablyCoding ComfortablyCoding left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above comments.

…on case

Instead of adding backend logic to distinguish between misconfigured
relationships and missing permissions, update the translation string
to cover both scenarios as suggested in PR review.

Closes directus#21337
@Ikromjon1998 Ikromjon1998 force-pushed the fix/relation-permission-backend branch from 73cb3a1 to b0d581d Compare March 26, 2026 22:47
@ComfortablyCoding ComfortablyCoding changed the title fix(api,app): return permission flag instead of silently filtering relations Update relationship_not_setup wording to clarify it may also result from missing permissions. Mar 27, 2026
Copy link
Copy Markdown
Member

@ComfortablyCoding ComfortablyCoding left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks LGTM 🚀 and congratulations on your first contribution to directus! 🥳

@ComfortablyCoding ComfortablyCoding changed the title Update relationship_not_setup wording to clarify it may also result from missing permissions. Update relationship_not_setup wording to clarify it may also result from missing permissions Mar 27, 2026
Copy link
Copy Markdown
Member

@AlexGaillard AlexGaillard left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🆒🫘

@AlexGaillard AlexGaillard merged commit cd5afd5 into directus:main Mar 27, 2026
68 checks passed
@github-actions github-actions bot added this to the Next Release milestone Mar 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Misleading warning in relational interfaces if user is has no read permission

4 participants