API Workflow privacy rules

[gustavo.motta]

Hey! I’m building an API Workflow that will be used by an external app, but I’m having a problem with privacy rules.

Basically, I have two tables: Teacher and Products. Each product has a owner(teacher), and each teacher has a user. A product is only visible for a user if it’s owner’s user is the current user, as you can see right here:

So I created an API Workflow that log the user in, and return if it has a product. By default, I would only have to do a search for the products and filter by the product I want to check, right?

The problem is, it’s not returning anything, it’s like the current user doesn’t have permission to see any product. Even when I return a search without any constraints it doesn’t return anything, I’m having to check the “Ignore privacy rules” box for it to work, but it’s not really good for performance, so I wanted to make it work just with privacy rules.

Any idea of what I’m doing wrong?

Here it’s the API Workflow and the response:

[Jici]

A backend WF apply privacy rules. To avoid this, you can use API key (so you can also remove this workflow can be run without authentication)

[gustavo.motta]

I actually can’t, because I do the authentication on this same Workflow.

My process is like this:

1. I call this endpoint on my external app, passing the parameters.
2. I log the user in using the parameters.
3. Then I do the search.

If I understood correctly the privacy rules and the API authentication, it shoud be working.

By the way, I also tried to split this workflow, making a workflow that can be run without authentication and log the user in, then I use the token and call another workflow, and also didn’t work.

The strange thing is that if I return any other data, the user name for example, it works just fine, it seems to be really a privacy rule problem.

[Jici]

How do you log in the user? You cannot do that in the same workflow. You need to do that in a separate workflow, this will return an access token that can be used in header after.
Are you following that:

Authentication | Bubble Docs

[gustavo.motta]

I wasn’t, but I had already tried that and didn’t work. Just for fun, I created two more API Workflows and did it like that again, and still the same.

Login API WF:

Second API WF (that should return the products):

The response (its just an empty search, so if the privacy rules were working, it shoud return only the products the teacher owns):

The test code I made:

What it returns:

I also checked multiple times on my database and the user I’m using has products. And if I check the “Ignore privacy rules” box, it works just fine

[Jici]

Can you try this: Change the GET endpoint to a POST endpoint

Also, are you on version 30? [Upgrade to Bubble version 30] Calls to backend workflows with API tokens fix

[Jici]

Got a deeper look to your screenshot… doesn’t seem to have any “authentication” error right? Just data not returned as it should? (based on the auth/privacy rules)

[georgecollier]

As @Jici points out, you should:

1. Have a backend workflow for logging in a user which has an ‘email’ and ‘password’ parameter
2. Log the user in action

When called, this will return a cookie that can be used to authenticate a subsequent request to whatever other backend workflow you actually want to call.

[gustavo.motta]

Yes, exactly! I’m starting to think that is some bug.

My app is on version 30 and I tried to change the method to POST on both workflows, but still the same:

Code:

Response:

[gustavo.motta]

Already did that, I created two other workflows like you described, it’s on posts 5 and 9. Still does’t return as it should.

[georgecollier]

What data are you returning from the API? And try adding the token as a ‘Cookie’ header rather than Authorization. You won’t need ‘Bearer’ before either.

[gustavo.motta]

I’m returning if there is a product the current user can view:

As for the header, I don’t really think it would change anything, because it’s not an authentication problem, if I return the current user name or email, it works, it just doesn’t return the data.

Now I tried showing the products on a repeating group and logged in as the user I’m using, and it looks like the user really doesn’t have acess to the data. So it’s really a privacy rules problem, I just don’t know what. Is there anything wrong with the privacy rules?:

I’m using 3 data types: User, Teacher and ProductStock. The product stock has an owner, that is a Teacher. The teacher has a user, that is a user. And if I’m not crazy, the rule is saying that when a ProductStock’s owner’s user is the logged user, the ProductStock is visible. I need this privacy rule because the users can’t see each others products.

Am I doing something wrong or forggeting to do something?

[georgecollier]

You can’t find it in searches because the privacy rule is too complex.

Add a User field to ProductStock and keep it in sync with the Owner Thing using a database trigger.

[gustavo.motta]

Is there any other workaround? I would have to create a user field on each table that uses a similar rule, just for that, or I would have to change the entire relationship to use the current user instead of the teacher, which isn’t really semantic, because I have multiple types of users, and the teacher is only one of them.