Hi.
We’re migrating from forest-express-sequelize to @forestadmin/agent.
We have the following models setup:
ExperienceTemplate <-- many-to-many --> Idea,
through a “bridge” table named ExperienceIdea.
Both the models have a sequelize relationship (they’re related in both directions):
// in the ExperienceTemplate model:
this.belongsToMany(models.Idea, {
through: models.ExperienceIdea,
foreignKey: 'idExperience',
otherKey: 'idIdea',
})
// in the Idea model:
this.belongsToMany(models.ExperienceTemplate, {
through: models.ExperienceIdea,
foreignKey: 'idIdea',
otherKey: 'idExperience',
})
In Forest Admin currently (with the old agent) we can disassociate an experienceTemplate from an Idea (and viceversa).
Here are the current permission settings (old agent) for the models fields:
Here are the roles permissions for the collections:
Thus, we can update (but not delete) the two models. And this is fine with our use case.
Allowing update we also allow the relationship update. Therefore with the old agent we can disassociate the relationship between one ExperienceTemplate record and one Idea record.
With the new agent, with the very same permission setup, we cannot any more.
With the new agent, when we disassociate (for example) one Idea record from one ExperienceTemplate record, we get the following error:
It looks like there’s some permission problem, because in our logs we see that the backend is returning a http 403 error to Forest (as we can see with the Chrome dev tools):
With the new agent, we had some struggle about this… and finally we found out that we could make this work by adding the DELETE permission to the role for the collections ExperienceTemplate and Idea. But we absolutely don’t want to allow the delete of these items! And we’re quite sure that the disassociate operation has nothing to do with the record deletion.
All this said, may you please doublecheck this feature in the new agent, please?
As far as you can tell, do you think that we’re doing some mistake?
PS: The many to many relationship is made with a bridge table. With the old agent we excluded that table from the list of models added to forest (as it’s just a technical item), using the exclude option in the Liana init call:
await Liana.init({
// various settings omitted...
excludedModels: [
// bridge table excluded
databases.sequelize.datamix.models.ExperienceIdea.name,
],
})
With the new agent, we couldn’t exclude this model, because we understood that it’s needed to fulfil all the paths between model relationships on Forest side. So we didn’t exclude it. And we just hid the collection from the collection list in the main forest dashboard.
But we had a couple of test with this collection permissions too and the observed behaviour does not change whichever setting we do: allowing all the (role related) permissions doesn’t fix. And the “realtionship” fields in the collection settings are NOT read only on both sides:
thus we hope to get news from you soon 
