Relations are not populated if API key is read-only

[ovlb]

Bug report

Describe the bug

In v4.0.0 relations inside API responses do not show up if the API key is set to «read-only». For this it does not matter how the populate query param is formatted (e.g. populate=* or populate[0]=authors&populate[1]=categories). This solution for deeply nested relations does not work either.

The only solution so far is to set the type of the API key to «Full Access». While this might be fine in some circumstances, it is not in other. (E.g. I’m currently building an 11ty site with Strapi as a CMS and the 11ty build should only have read access.

Steps to reproduce the behavior

1. Go to Settings ->
2. Create a new API key with read-only permissions
3. Create a new model w/ some relations (the restaurant example from the docs or this one).
4. Request the page in Paw or another API client, using the API token, and the populate=* query param
5. Relations are not showing up

Expected behavior

Relations should be populated

Screenshots

Figure 1: API response with a read-only API key

Figure 2: API response with a full access API key (expected behaviour)

System

• Node.js version: v14.5.0/v16.13.1
• NPM version: v6.14.5/v.8.1.2
• Strapi version: v4.0.0
• Database: Postgres
• Operating system: macOS/Ubuntu

[hs737]

I am seeing the same issue. I'm using "Full Access" as a temporary workaround.

My system details:
Node.js Version: v14.15.2
NPM version: v6.14.9
Strapi version: v4.0.0
Database: Postgres
Operating system: macOS

[jaimin1531]

I am also facing this same issue in strapi v4.0.0

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/discussion-regarding-default-population-of-rest/13395/21

[JonasGruenwald]

I’m facing this issue as well.

Just to be sure I’m understanding this correctly, the full access token would give write access to the whole project right? So I can’t use this workaround if I’m trying to query the api directly from frontend code because I would be publicly exposing a token with write access?