User and Folder Permission Management Broken After Upgrade to 3.2.3.1

[DarkRoMiCH]

TeamPass version

3.2.3.1

Environment

Docker

Your question

Has anyone encountered this issue after upgrading TeamPass from version 3.2.2.6 to 3.2.3.1?
The Users and Folders tabs, particularly folder access permission management, stopped working correctly after the upgrade.
Is there a known solution or workaround for this issue? Are there any additional migration steps, database updates, or configuration changes required after upgrading to version 3.2.3.1?
Any help or suggestions would be greatly appreciated.

Before posting

• This is not a reproducible bug (otherwise → Issues)

[DarkRoMiCH]

The issue was resolved by manually adding the missing deletion_protected column to the teampass_nested_tree table. The column was not created during the upgrade from TeamPass 3.2.2.6 to 3.2.3.1, causing errors on the Users and Folders tabs.

The following SQL command fixed the issue:

docker exec teampass-db sh -lc '
export MYSQL_PWD="$MARIADB_ROOT_PASSWORD"
mariadb -u root teampass -e "
ALTER TABLE teampass_nested_tree
ADD COLUMN deletion_protected TINYINT(1) NOT NULL DEFAULT 0;
"
'

After adding the column, the database schema was correct and the issue was resolved.

[guerricv]

Hello @DarkRoMiCH,
I'm not familar with docker environment but, it looks like a database upgrade not been performed in the upgrade process. Did you performed it ?

[nilsteampassnet]

Hello @DarkRoMiCH, and thanks @guerricv for pointing in the right direction.

This is a bug in the automatic upgrade of the Docker image, not something you missed.

What happened

teampass_version only stores 3.2.2, while the 3.2.2.x patch releases kept adding migrations to the 3.2.2 upgrade script. When your 3.2.3.1 container started, its entrypoint treated the 3.2.2 step as already applied and ran the 3.2.3 migration alone. Everything 3.2.2.7 and 3.2.2.8 had added to the 3.2.2 migration was skipped, including the nested_tree.deletion_protected column, which is why the Users and Folders pages failed. The web upgrade wizard is not affected because it replays every script.

Adding the column is not enough

The skipped step also contains:

• the sealing of the transparent key recovery backups with the instance key (security fix GHSA-fv78-jwjv-pj25, 3.2.2.7),
• the encryption of the LDAP bind and SMTP passwords stored in the settings (3.2.2.8),
• two Secure Send settings (public_entity_name, secure_send_show_sender_name).

To apply them, back up the database, then record an older version so that the container replays the 3.2.2 and 3.2.3 migrations:

docker exec teampass-db sh -lc 'MYSQL_PWD="$MARIADB_ROOT_PASSWORD" mariadb-dump -u root teampass' > teampass-backup.sql

docker exec -i teampass-db sh -lc 'MYSQL_PWD="$MARIADB_ROOT_PASSWORD" mariadb -u root teampass' <<'SQL'
UPDATE teampass_misc SET valeur = '3.2.1' WHERE type = 'admin' AND intitule = 'teampass_version';
SQL

Then recreate the application container. A plain restart is not enough, because the install directory was removed after the first upgrade:

docker compose up -d --force-recreate teampass
docker compose logs teampass | head -60   # expect "Applying 3.2.2..." then "Applying 3.2.3..."

The migrations are idempotent, so the column you added by hand is detected and left as it is.

Fix

From the next release, the entrypoint replays the migration of the recorded version on every upgrade, so a jump from any 3.2.2.x image to 3.2.3.x applies the full 3.2.2 migration. The database will also record the full release that last upgraded it (teampass_version_full), so a gap like this one becomes visible.

I'm closing this discussion as resolved. Feel free to reopen it if the replay reports an error.