Erroneous permission denied error for custom user role

[bronwyncombs]

Describe the bug A clear and concise description of what the bug is.

I’ve been attempting to set up roles with permissions similar to our previous “Limited access user” and “full access user” roles (basically a broad ability to edit and create new of most things, just not delete). They seem to work fine for adding new specimens but when editing old ones we are generating some variation on the following error (s):

on test panel, copy of db is cfiaseedherbaria_08_19_2024 admin user: spadmin limited access user: joness

joness has limited access user role that was defined by another user

User Roles - Limited Access user - Tue Aug 20 2024.json

For reference, here is the full access user role as well User Roles - Full Access user - Tue Aug 20 2024.json

Both user rolls have table > all tables selected with all permission boxes except delete checked

However, as reported, when a user with the limited access user role tries to modify and save a CO, there is a permission denied error.

The fields in the ss above are startDatePrecision and endDatePrecision from the CE table, note that endDatePrecision is not on the CE form and is hidden in schema config.

To Reproduce Steps to reproduce the behavior:

1. Go to cfiaseedherbaria_08_19_2024 and log in with user joness
2. Find a CO record
3. Edit it and save
4. See error

Expected behavior User with this role should be able to modify and save CO records without error

Screenshots If applicable, add screenshots to help explain your problem.

• OS: macOS
• Browser: Chrome
• Specify 7 Version: v7.9.6.2
• Database Name: cfiaseedherbaria_08_19_2024
• Collection name: National Seed Herbarium
• User Name: spadmin and joness

Reported By Taran @ CFIA

[grantfitzsimmons]

From Taran:

I tested the “Full Data Access” pre-loaded role but it has the same issue. However, I think I was able to resolve the permissions issue by adding an “All” policy to our Roles and then only selecting the relevant boxes for each role (Full Access and Limited access). I will have to check a bit more to make sure I haven’t enabled something we didn’t want but it seems to work at the moment.