Field level permissions are not given to Specify 6 users automatically

[grantfitzsimmons]

This is the place that gives roles to users:

specify7/specifyweb/permissions/initialize.py

Lines 57 to 63 in ecf340e

	# Give them access to the collection.
	UserPolicy.objects.create(
	collection_id=colid,
	specifyuser_id=user.id,
	resource=CollectionAccessPT.access.resource(),
	action=CollectionAccessPT.access.action(),
	)

It does not give the field access policy.

The field access policy is given on the front-end if you check "Collection Access" and save.

Alternatively, all default roles have the field access policy. You can assign any of them to this user to fix the issue.

---

I am getting a TypeError when editing a determination

https://herbrbge-edge.test.specifysystems.org/specify/view/collectionobject/667276/?recordsetid=218

User: elspeth

It seems likely that it is related to a permission issue as admins do not have this problem. I can verify that is the case as well.

---

Abridged Max:

...the field-level permission system is actually already implemented on the back-end

For now, when you create a user, front-end automatically gives a permission to edit all fields in all tables (the back-end allows editing fields only if you have permission to edit the table itself)

The exception itself on the screenshot occured because front-end tried to convert the database name for the field-level policy to a human friendly label, but failed, because the labels for those are not yet defined

This user was most likely created in Specify 6 according to RBGE.

---

Actually, it appears that the permission migration might have a bug where it forgets to add this policy.
I am asking Ben to double check. If that's indeed the case, then making any edits to the policy list for a user or role will add the missing /field/% policy (even though it is not shown in the UI.
This will resolve the TypeError exception you seen

Reported By: RBGE

[maxpatiiuk]

This is the place that gives roles to users:

specify7/specifyweb/permissions/initialize.py

Lines 57 to 63 in ecf340e

	# Give them access to the collection.
	UserPolicy.objects.create(
	collection_id=colid,
	specifyuser_id=user.id,
	resource=CollectionAccessPT.access.resource(),
	action=CollectionAccessPT.access.action(),
	)

It does not give the field access policy.

The field access policy is given on the front-end if you check "Collection Access" and save.

Alternatively, all default roles have the field access policy. You can assign any of them to this user to fix the issue.

[maxpatiiuk]

Also happened to Willem at SAIAB (see #2949)

[maxpatiiuk]

To elaborate on this more, the problem can be solved by adding a policy with the resource of /field/% and action of % to any place where it would apply to this user.

It is included for all default roles. It is also included for users if "Collection Access" checkbox is checked (in the UI, not via the database)