"fields" and "additional_fields" ignored in sync/config.json

[RenaudAubert]

Hi!

I have permissions for a type object and default rules. I've deployed these changes using web UI and it works great.

The problem is when I try to pull the changes made in the UI using realm-cli the fields "fields" and "additional_fields" are not included same if I add them in my code and then push using cli.

Here's what I have

{
        "rules": {
            "Project": [
                {
                    "name": "readAuthorizedProject",
                    "applyWhen": {},
                    "write": {
                        "users": "%%user.id"
                    },
                    "fields": {
                        "sections": {
                            "write": true
                        }
                    },
                    "additional_fields": {
                        "read": true,
                        "write": false
                    }
                }
            ]
        },
        "defaultRoles": [
            {
                "name": "read-write",
                "applyWhen": {},
                "read": true,
                "write": true
            }
        ]
    }

And here's what I get if I pull

    {
        "rules": {
            "Project": [
                {
                    "name": "readAuthorizedProject",
                    "applyWhen": {},
                    "write": {
                        "users": "%%user.id"
                    }
                }
            ]
        },
        "defaultRoles": [
            {
                "name": "read-write",
                "applyWhen": {},
                "read": true,
                "write": true
            }
        ]
    }

I thought it might be the cli or app services simplifying my rules because they were unnecessarily complex but after testing my version is working as expected wheras the one with missing field is not what I want.

[jonatlee]

Hi,

Do you mind linking the URL to your app (looks like https://realm.mongodb.com/groups/${}/apps/${})? I can take a deeper look into it and see if there is anything unexpected happening there.

Jonathan

[RenaudAubert]

Hi @jonatlee

Here's my app https://realm.mongodb.com/groups/638f3be09535df332e3a0868/apps/6390abd5cfb88b0269283770

PS: forgot to mention I'm using realm-cli v 2.6.2

[jonatlee]

Hey, I took a look and tested this out on my own app, and was able to reproduce the same behavior (ie, field-level permissions silently getting ignored in pushing/pulling the app). I've filed a ticket to resolve this -- thank you for alerting the team of this issue.

As an FYI, this way of setting permissions is becoming deprecated in the near future (within the next few releases). The new system that we are introducing will merge in these permissions with the Rules that are defined in the "Rules" page, with the idea being that the set of permissions defined there will be the single source of truth for all app services involving a MongoDB cluster (GraphQL, Flexible Sync, DataAPI, etc.)

Jonathan

[RenaudAubert]

Thank you @jonatlee 🙏

Hope it'll get fixed soon.

Regarding the new rules, is it something that we should already start to implement ? I noticed the new "rules" tab on the App Services UI but there is still a textbox in the device sync section to set rules

[jonatlee]

Hi @RenaudAubert, we will be performing a migration to handle moving everything over; no additional action items will be necessary from your end. At this time, if you want to modify your permissions, please continue to use the permissions JSON editor in the Device Sync configuration page.

Jonathan