Saved Questions permission setting not saved

[timmclaughlin]

Upgraded to 0.33preview2 from 0.32 and now my users with limited access cannot query any data - it just spins on "Loading..." They can login and see the saved questions in their intended collection the same as previous versions, but after clicking the saved question, the data cannot be queried. I tried to set the "Saved Questions" permission for All Users in the Permissions UI since it was showing as that they had no access to the data, but that fails with the following error (there seems to be a separate UI bug mentioned here: #5610 (comment)).

Logs show after clicking Save Changes:
Aug 04 12:54:52 ERROR metabase.middleware.log :: PUT /api/permissions/graph 500 7 ms (0 DB calls)
{:value
[{:revision 8,
:groups
{7 {3 {:native :none, :schemas :none}},
1 {3 {:native :none, :schemas :none}, -1337 {:native nil, :schemas :all}},
4 {3 {:native :none, :schemas :none}},
6 {3 {:native :none, :schemas :none}},
12 {3 {:native :none, :schemas :none}},
2 {3 {:native :write, :schemas :all}},
11 {3 {:native :none, :schemas :none}},
9 {3 {:native :none, :schemas :none}},
5 {3 {:native :write, :schemas :all}},
10 {3 {:native :none, :schemas :none}},
8 {3 {:native :none, :schemas :none}}}}],
:error [(named {:groups {1 {(not ("Integer greater than zero" -1337)) invalid-key}}} new-graph)],
:message "Input to update-graph! does not match schema: \n\n\t [(named {:groups {1 {(not ("Integer greater than zero" -1337)) invalid-key}}} new-graph)] \n\n",
:type clojure.lang.ExceptionInfo,
:stacktrace
("--> models.permissions$fn__26804$update_graph_BANG___26813.invoke(permissions.clj:603)"
"api.permissions$fn__61776.invokeStatic(permissions.clj:80)"
"api.permissions$fn__61776.invoke(permissions.clj:68)"
"middleware.auth$enforce_authentication$fn__45957.invoke(auth.clj:14)"
"routes$fn__63780$fn__63781.doInvoke(routes.clj:56)"
"middleware.exceptions$catch_uncaught_exceptions$fn__45861.invoke(exceptions.clj:104)"
"middleware.exceptions$catch_api_exceptions$fn__45858.invoke(exceptions.clj:92)"
"middleware.log$log_api_call$fn__45779$fn__45780.invoke(log.clj:170)"
"middleware.log$log_api_call$fn__45779.invoke(log.clj:164)"
"middleware.security$add_security_headers$fn__45822.invoke(security.clj:105)"
"middleware.json$wrap_json_body$fn__46040.invoke(json.clj:61)"
"middleware.json$wrap_streamed_json_response$fn__46058.invoke(json.clj:97)"
"middleware.session$bind_current_user$fn__46172$fn__46173.invoke(session.clj:193)"
"middleware.session$do_with_current_user.invokeStatic(session.clj:176)"
"middleware.session$do_with_current_user.invoke(session.clj:170)"
"middleware.session$bind_current_user$fn__46172.invoke(session.clj:192)"
"middleware.session$wrap_current_user_id$fn__46161.invoke(session.clj:161)"
"middleware.session$wrap_session_id$fn__46146.invoke(session.clj:123)"
"middleware.auth$wrap_api_key$fn__45965.invoke(auth.clj:27)"
"middleware.misc$maybe_set_site_url$fn__45924.invoke(misc.clj:58)"
"middleware.misc$bind_user_locale$fn__45927.invoke(misc.clj:74)"
"middleware.misc$add_content_type$fn__45912.invoke(misc.clj:30)"
"middleware.misc$disable_streaming_buffering$fn__45949.invoke(misc.clj:119)"
"middleware.misc$wrap_gzip$fn__45942.invoke(misc.clj:101)")}

[flamber]

Hi @timmclaughlin
When it just spins with "loading...", do you see any errors in the browser console or Metabase log?

[timmclaughlin]

Good call. It’s a javascript error (may be permissions too, but it looks like it might not be even hitting the server). I tested it with a user that has full permissions, and the only console error they get is the DEPRECATED fetchDatabases warning...  

[flamber]

@timmclaughlin I was trying to get you to post the javascript error. And you should upgrade to 0.33.0-RC1, while I would recommend not to run test releases in production, that's a bit too late.

[timmclaughlin]

@flamber Posted the error above. Didn't realize that email lost the images. Won't do that again. Also upgraded to RC1 and no changes to either the Javascript error, nor the attempted saving of the permissions.

[flamber]

@timmclaughlin
Which browser are you using?
You cannot change permissions of "Saved Questions". And it should be hidden. #5610
I'm fairly sure you're seeing some other errors, like no data permissions, but without the exact error it's difficult to point to the right bug.
Otherwise, you could try to backup your metadata and then downgrade to 0.32.10

[timmclaughlin]

@flamber I am using Chrome and Safari both on OS X and see the same problem. The thing is that this used to work before I upgraded no problems, and it seems like it should work still now because the user has View permissions on the collection and can see the Questions, they just won't load.

Are you saying that you should always have access to Saved Questions if you can see them in the Collection? That would make sense to me...

I'll try to downgrade.

[flamber]

@timmclaughlin
Remember to backup before upgrade/downgrade!
You say "they just won't load" - do you see any errors in the Metabase log or browser console?
I think you might be seeing an issue, where saved questions are not loaded, when the user has no Data/SQL permissions. But more information would be really helpful.
But I'm fairly sure you can totally ignore the errors in Admin > Permissions.

[timmclaughlin]

@flamber I suspect you are correct about the permission issue, but I see no errors in the server side log and only see the Javascript errors that I posted earlier.

[flamber]

@timmclaughlin Okay, ignore Admin > Permissions. The problem is not there.
You wrote "user has View permissions on the collection and can see the Questions, they just won't load" - what does that mean? Do they see an error?

[timmclaughlin]

@flamber No, it hangs on the screen with the "Loading" spinner, I'm guessing due to the Javascript errors that I posted above. I suspect that it never even hits the server, or if it does so, it never causes an error because I would see that in the logs.

[flamber]

@timmclaughlin
Which version are you using now?
The javascript error in the first post only happens, when you're saving changes on Admin > Permissions page. Users don't have access to that.
Open an icognito window, open the browser console so you'll see all errors from the beginning, and then start by logging in as a user and clicking into questions you know will fail.
I'm fairly sure it might be a fix of several errors like "React Error" and "Permissions denied".

[timmclaughlin]

@flamber
This is what I get when I try to view the question as the limited access user. There is no problem for the user with sufficient privileges.

[flamber]

@timmclaughlin I'm almost certain that you're seeing issue #10402, which hopefully will be fixed before 0.33.0. But you option right now is to downgrade to 0.32.10 or give users data permissions.
Please close this issue 👍

[timmclaughlin]

@flamber yeah it sure looks like it. Sorry for the dupe.

[timmclaughlin]

@flamber FYI, I did try to give them data permissions, but there is a bug there as well, that I described earlier. It won't save the permissions.

[mazameli]

Yep, we're actively looking at #10402 at the moment.

[flamber]

@timmclaughlin Maz already re-opened issue #5617, since you should not even see "Saved Questions" under Permissions, so that part will be tracked there.