NOTICE: Population of Relations, Media, Component, and Dynamic Zone fields

[derrickmehaffy]

Please see this discussion forum thread to talk about this further: https://forum.strapi.io/t/discussion-regarding-default-population-of-rest/13395

Hello everyone,

Since we have launched the Strapi v4 we have seen an increase in the number of issues regarding automatic population of the following:

• Relations
• Media Fields
• Components
• Dynamic Zones

None of these are populated by default in the v4, this is intended functionality largely for performance reasons. We have a temporary documentation page on this here (yes it says relations, but applies to all of the above listed):

https://docs.strapi.io/developer-docs/latest/developer-resources/database-apis-reference/rest-api.html#relations-population

And we are currently working on a massive refactoring to this documentation in the following PR:

strapi/documentation#541

---

Please refrain from opening additional issues on the population topic, I will leave this notice unlocked so if you wish to discuss it, you may do so here.

[eikaramba]

assuming a posts<->user relationship, how should we then secure the users endpoint if populating and allowing find & findOne permission is required on users? see #11740 (comment)

correct me if i am wrong but for me currently in v4 you either have no relationships to the current user or you have to complete open access to every user, which would be big security issue. hopefuly for me and others this is just a big misunderstanding of how strapi v4 is supposed to work.

[NadhirBenLazhar]

1. Start new Strapi v4 project.
2. Add avatar as media content type field in user model.
3. Activate USERS & PERMISSIONS > ROLES > PUBLIC: ALL Permissions Activated
4. This request works fine (without avatar in response) as expected:

GET http://localhost:1337/api/users

5. Try to populate avatar does not work with users. I tried with these requests:

GET http://localhost:1337/api/users?populate=avatar
GET http://localhost:1337/api/users?populate=true
GET http://localhost:1337/api/users?populate=*
GET http://localhost:1337/api/users?fields=*

6. In another project; The user has many relations. no one works with populate.

GET http://localhost:1337/api/users?populate=posts

7. The Terminal error:

[2021-12-04 21:42:41.037] error: select `t0`.* from `up_users` as `t0` where (`t0`.`populate` = 'avatar') - ER_BAD_FIELD_ERROR: Unknown column 't0.populate' in 'where clause'
Error: ER_BAD_FIELD_ERROR: Unknown column 't0.populate' in 'where clause'

8. The response error:

{
    "data": null,
    "error": {
        "status": 500,
        "name": "InternalServerError",
        "message": "Internal Server Error"
    }
}

9. I tested this using two (2) strapi projects with:

• PostgreSQL-NO-SSL
• MySQL-YES-SSL

10. Other models work fine with populate. as expected. like this one:

GET http://localhost:1337/api/categories?populate=posts

Thank you.

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/strapi-v4-api-response-does-not-show-relationships/13095/2

[rmrantunes]

I noticed that. Is there any way to start a new Strapi v3.x.x project right now?

[ovlb]

Crossposting from the forum w/ more details:

For me, this mechanism isn’t working at all. I spun up a new Strapi instance yesterday (v4.0.0, using Postgres without SSL).

Given the following schema:

{
  "kind": "collectionType",
  "collectionName": "posts",
  "info": {
    "singularName": "post",
    "pluralName": "posts",
    "displayName": "Posts",
    "description": ""
  },
  "options": {
    "draftAndPublish": true
  },
  "pluginOptions": {},
  "attributes": {
    "Title": {
      "type": "string",
      "required": true
    },
    "Slug": {
      "type": "string",
      "required": true,
      "unique": true
    },
    "Content": {
      "type": "richtext",
      "required": true
    },
    "authors": {
      "type": "relation",
      "relation": "oneToMany",
      "target": "plugin::users-permissions.user"
    },
    "users": {
      "type": "relation",
      "relation": "manyToMany",
      "target": "plugin::users-permissions.user",
      "inversedBy": "posts"
    },
    "categories": {
      "type": "relation",
      "relation": "manyToMany",
      "target": "api::category.category",
      "inversedBy": "posts"
    }
  }
}

Categories are basically the same as in the restaurant example from the docs.

{
  "kind": "collectionType",
  "collectionName": "categories",
  "info": {
    "singularName": "category",
    "pluralName": "categories",
    "displayName": "Category"
  },
  "options": {
    "draftAndPublish": false
  },
  "pluginOptions": {},
  "attributes": {
    "Title": {
      "type": "string"
    },
    "posts": {
      "type": "relation",
      "relation": "manyToMany",
      "target": "api::post.post",
      "inversedBy": "categories"
    }
  }
}

No matter how I use the populate parameter, the relations are never showing up in the response. The status code is always 200.

GET http://localhost:1337/api/posts?populate=*
GET http://localhost:1337/api/posts?populate%5Bcategories%5D=*
…

I can break the server by e.g. doing

GET http://localhost:1337/api/posts?populate%5Bcategories%5D=Title

which throws

[2021-12-05 14:39:03.151] error: Invalid nested populate. Expected '*' or an object

But I guess this is intended.

In the lifecycle hooks, the populate relations are showing up, however, and in the UI too.

As I am new to Strapi I might miss something? Any hints would be appreciated.

[NadhirBenLazhar]

@rmrantunes

You can list all create-strapi-app versions:
npm view create-strapi-app versions --json

To create Strapi v3 project:
npx create-strapi-app@3.6.8 my-project

Don't forget to downgrade your node version.
nvm install lts/fermium
or
nvm install v14.18.2

then

nvm use v14.18.2
nvm alias default v14.18.2

good luck.

[jdavidferreira]

I tried following the instructions that are mentioned in the temporary documentation page to retrieve all their first-level relations (/api/posts?populate=*) but it is not working.
It also doesn't work if I specify the name of the relationship (/api/posts?populate=topics).

All the posts and topics are in published state. I am using an API Token.

node.js v14.18.1
strapi v4
mysql v5.7

[MichaelTao]

Crossposting from the forum w/ more details:

For me, this mechanism isn’t working at all. I spun up a new Strapi instance yesterday (v4.0.0, using Postgres without SSL).

Given the following schema:

{
  "kind": "collectionType",
  "collectionName": "posts",
  "info": {
    "singularName": "post",
    "pluralName": "posts",
    "displayName": "Posts",
    "description": ""
  },
  "options": {
    "draftAndPublish": true
  },
  "pluginOptions": {},
  "attributes": {
    "Title": {
      "type": "string",
      "required": true
    },
    "Slug": {
      "type": "string",
      "required": true,
      "unique": true
    },
    "Content": {
      "type": "richtext",
      "required": true
    },
    "authors": {
      "type": "relation",
      "relation": "oneToMany",
      "target": "plugin::users-permissions.user"
    },
    "users": {
      "type": "relation",
      "relation": "manyToMany",
      "target": "plugin::users-permissions.user",
      "inversedBy": "posts"
    },
    "categories": {
      "type": "relation",
      "relation": "manyToMany",
      "target": "api::category.category",
      "inversedBy": "posts"
    }
  }
}

Categories are basically the same as in the restaurant example from the docs.

{
  "kind": "collectionType",
  "collectionName": "categories",
  "info": {
    "singularName": "category",
    "pluralName": "categories",
    "displayName": "Category"
  },
  "options": {
    "draftAndPublish": false
  },
  "pluginOptions": {},
  "attributes": {
    "Title": {
      "type": "string"
    },
    "posts": {
      "type": "relation",
      "relation": "manyToMany",
      "target": "api::post.post",
      "inversedBy": "categories"
    }
  }
}

No matter how I use the populate parameter, the relations are never showing up in the response. The status code is always 200.

GET http://localhost:1337/api/posts?populate=*
GET http://localhost:1337/api/posts?populate%5Bcategories%5D=*
…

I can break the server by e.g. doing

GET http://localhost:1337/api/posts?populate%5Bcategories%5D=Title

which throws

[2021-12-05 14:39:03.151] error: Invalid nested populate. Expected '*' or an object

But I guess this is intended.

In the lifecycle hooks, the populate relations are showing up, however, and in the UI too.

As I am new to Strapi I might miss something? Any hints would be appreciated.

I ran into this issue. What happened in my case was, I was using the new API token and I only had read-only. If you give it full access it should work.

The alternative solution is to give public role access to the content type (find)

[ovlb]

I ran into this issue. What happened in my case was, I was using the new API token and I only had read-only. If you give it full access it should work.

Ahh yeah. Thank you!

However, that feels quite unintuitive. I’m using the API token for a static site generator and it should not need full access to build the site, as I’m never manipulating data. Updating the public permissions also does not feel too great.

[vtenfys]

I ran into this issue. What happened in my case was, I was using the new API token and I only had read-only. If you give it full access it should work.

The alternative solution is to give public role access to the content type (find)

I had this issue too - creating a full access API token worked, but adjusting the public roles did not.

However, that feels quite unintuitive. I’m using the API token for a static site generator and it should not need full access to build the site, as I’m never manipulating data. Updating the public permissions also does not feel too great.

I agree with this - it seems strange that read permission is not enough.