Strapi is not honoring the settings when reading the permissions

[robsonpiere]

Bug report

Required System information

• Node.js version: v18.18
• NPM version: 9.8.1 yarn/1.22.19
• Strapi version: 4.5.15
• Database: postgres 15
• Operating system: Linux / ubuntu and alpine
• Is your project Javascript or Typescript: Typescript

Describe the bug

When you remove the permission to update a field for the Editor profile, this change is not saved in the database after refersh. When you return to the application, you can see that the permission is maintained, both in production and in development.

Steps to reproduce the behavior

1. Go to the settings menu -> administrative panel -> roles
2. Select the editor profile
3. Choose a content type (in my example article) and remove the update permission from a field (slug in my example)
4. When you save, it will appear that the change has been made, but the bank has not changed the configuration and when you reload the page (or run strapi develop) again you will see that the change has not taken effect.

Expected behavior

When you save, it will appear that the change has been made, but the bank has not changed the configuration and when you reload the page (or run yarn develop) again you will see that the change has not taken effect.

Screenshots

Remove permission:

After running strapi develop again (in development) or update the page in production:

Code snippets

N/A

Additional context

N/A

[edporras]

I'm seeing the same problem also on 4.15.4

[trungnouden1108]

I had the same issue, It seems like the default permissions are only set for required fields

[edporras]

I had to revert all the way back to 4.14.4 to get the setting to stick.

I take this back. Yesterday I thought tested login out / in and restarting my setup and I thought it stuck but today it's back to not saving the permissions.

[edporras]

I looked into this behavior a bit with a clean install of our strapi using our content-types. I created a new user with the predefined Author role and did a DB dump to have a base to start from. I then

1. updated the Author role to disable update of one of the non-required fields from one of our collections, then dumped the DB.

• I see that the table public.admin_permissions was changed - one entry for plugin::content-manager.explorer.update corresponding to the modified collection was deleted and a new one was added without the field I deselected.
• public.admin_permissions_role_links was similarly updated to remove / add a row with the corresponding ids.
• two selects were added to set public.admin_permissions_id_seq and public.admin_permissions_role_links_id_seq with the added id using the value of true

2. Then I repeated the same steps using a required field this time and the resulting behavior was the same. The tables were updated as done for the non-required field along with adding the two selects to set the values to true.

So, to me, it looks like the problem is instead that Strapi is not honoring the settings when reading the permissions. The DB looks like it should be valid. (@robsonpiere I think we should edit the title to reflect this?)

I've tried looking through the code but I have no idea where to start and JS/TS is not my forte. If someone could point out how Strapi reads these configs at boot, maybe I could try and look.

I hope this gets resolved soon because we can't allow our users to accidentally edit fields that should be left alone. 😬

[pcriadoperez]

I'm seeing a similar issue of where I set a permission for a custom service, and when resetting strapi, the permissions get reset.