I can't edit the role permissions

[abdonrd]

Describe the bug

I can't edit the role permissions

Steps to reproduce the behavior

I have tried to remove the delete permission in the Battle collection type, but I can't

Expected behavior

Allow to edit it.

Screenshots

System

• Node.js version: v12
• NPM version: v6
• Strapi version: v3.2.3
• Database: MongoDB
• Operating system: macOS

[jlsjonas]

Noticing the same behavior, but for adding more user-role permissions.
It saves, PUT gets sent correctly and comes back with a 200 OK; there must be something off in the backend.

In my case, it's one of my single types, and one of my collection types; so it seems unrelated to that.

[soupette]

@abdonrd are you using the community edition?

In community edition you cannot set the permission on a field level, this is a feature that only entreprise edition can have.

[abdonrd]

Yeah, community edition.

But I don't say at the field level, but at the collection type level.
For example in the screenshoot, remove the Delete permission in the Battle collection type.

[8byr0]

Agree with @abdonrd, the behaviour is not clear for that module.
If it's not possible to delete or edit a predefined role then:

• buttons should be disabled / styled in a different way (for delete button in roles list)
• a notice should be available on edit page "You're using strapi CE which does not allow to edit fields, link to EE to learn more"

If it sounds relevant to you, I can make a PR

[abdonrd]

Anyway, I had understood that the limitation of the community version is to have only 3 roles. But being able to edit those 3 roles as we want. Otherwise the limitation complicates the functionality a lot.

[jlsjonas]

@abdonrd Can you modify permissions for other types? If so, I suspect that the underlying issue will be the same for the Users & Permissions plugin. I duplicated the type that was stuck and it is working as expected now (combination of certain names/renames causing unexpected behavior?)

Edit: if so, it looks like the content-manager was in an inconsistent state for my "home" single type (one of the 2 having issues)
the following error came back when trying to delete it (after replacing it to not be blocked)

[2020-10-12T11:22:44.380Z] error Bootstrap function in plugin "content-manager" failed
[2020-10-12T11:22:44.380Z] error Error: entry.notFound
    at deleteOne (/path/to/project/node_modules/strapi-connector-mongoose/lib/queries.js:489:19)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)
    at async Promise.all (index 1)
    at async Object.delete (/path/to/project/node_modules/strapi-database/lib/queries/helpers.js:15:18)
    at async Promise.all (index 1)
    at async updateContentTypes (/path/to/project/node_modules/strapi-plugin-content-manager/config/functions/bootstrap.js:41:3)
    at async syncContentTypesSchemas (/path/to/project/node_modules/strapi-plugin-content-manager/config/functions/bootstrap.js:55:3)
    at async module.exports (/path/to/project/node_modules/strapi-plugin-content-manager/config/functions/bootstrap.js:172:3)
    at async Promise.all (index 0)
    at async Strapi.runBootstrapFunctions (/path/to/project/node_modules/strapi/lib/Strapi.js:404:5)
    at async Strapi.load (/path/to/project/node_modules/strapi/lib/Strapi.js:336:5)
    at async Strapi.start (/path/to/project/node_modules/strapi/lib/Strapi.js:190:9)

[JabStrapi]

The 3 roles in Community Edition are indeed predefined and cannot be edited @abdonrd.
Yet at a Content-Type and (to some extent) at a field level, one can choose to grant Author and Editor roles access or not to some content. 

This means that you can choose which Content-Type is available to which role (author/editor, because Super Admin has every permission by default) but as soon as you give permission on a content (Content-type or field) to one role, then this role will be granted all the permissions (CRUD) on it (in the limit of the predefined conditions applied. For example an author cannot publish content). 

This has been made for consistency matters since we wanted both to provide default roles that could be useful for most of our users and to maintain them predefined so that they can welcome all our features. In other words, the default roles permission settings view in Community Edition works "inline" but you are right, it would worth further explanation in-app as you suggested @8byr0. We'll make a PR soon for that (because it needs a design).

[lauriejim]

This issue has been mentioned on Strapi Community. There might be relevant details there:

https://forum.strapi.io/t/rbac-role-based-access-control-feature-discussion/433/1

[derrickmehaffy]

Closing / Locking thread in favor of the above forum thread ^^