# Smart actions not working anymore after upgrade to v8

**URL:** <https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996>\
**Category:** Help me!\
**Created:** [July 27, 2021, 2:30pm UTC](https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996 "2021-07-27T14:30:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vincent\_Francois](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/vincent_francois/32/882_2.png) [@Vincent\_Francois](https://community.forestadmin.com/u/Vincent_Francois)\
**Post date:** [July 27, 2021, 2:30pm UTC](https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996/1 "2021-07-27T14:30:30Z")

</div>

At Inato, we are using forest-express-sequelize but we define our own express handlers. Sequelize is only used to create the data models and we don’t use it to connect to the database.

## Expected behavior

When using smart actions, they should call our corresponding handler without any error.

## Actual behavior

When using smart actions, we receive the error `{"error":"Smart Action: failed to evaluate permissions"}`  
We can see in [this file](https://github.com/ForestAdmin/forest-express/blob/5816ee2d81129233df1a341cdc40c76e4e516493/src/middlewares/permissions.js) that it’s caused by `_ensureRecordIdsInScope` that instantiate a `RecordsCounter` to verify that the user has access to the smart action’s ids attribute.  
As we don’t use sequelize to access the database, this is failing, hence the issue.

## Failure Logs

Please include any relevant log snippets, if necessary.

## Context

Please provide any relevant information about your setup.

- Package Version: 8.0.4
- Express Version: 4.17.1
- Sequelize Version: 6.6.5
- Database Dialect:
- Database Version:
- Project Name:

---

<div class="post-metadata">

**Author:** ![anon39940173](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@anon39940173](https://community.forestadmin.com/u/anon39940173)\
**Post date:** [July 27, 2021, 3:01pm UTC](https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996/2 "2021-07-27T15:01:15Z")

</div>

Scopes are a feature that allow to hide records from users, depending on their team.  
This is done server-side for security reasons.

When scopes are configured, the agent ensures that:

- Charts, lists and relationships lists exclude out of scope records
- Getting an out of scope record returns a 404
- Users cannot call smart actions, nor update or delete out of scopes records

Your issue comes from the fact that, since the V8, the `permissionMiddlewareCreator.smartAction()` middleware will check that the query that comes from the browser does not try to update records which are out of scope.

This needs performing a query to the database, hence the call to sequelize.

If you are not using scopes, and wish to skip the check, you can replace all calls to `permissionMiddlewareCreator.smartAction()` by `permissionMiddlewareCreator._checkPermission('actions')`

For information:

- `_ensureRecordIdsInScope()` is the private method that checks that the records are in scope.
- `_checkPermission('actions')` is the private method that checks current user roles allow him to call the smart action.
- `smartAction()` is the middleware you’ve been using, and does both.

This is not ideal, as those private methods are _not_ part of the stable API, and may change between minors when you upgrade your agent next time

---

<div class="post-metadata">

**Author:** ![Vincent\_Francois](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/vincent_francois/32/882_2.png) [@Vincent\_Francois](https://community.forestadmin.com/u/Vincent_Francois)\
**Post date:** [July 28, 2021, 7:22am UTC](https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996/3 "2021-07-28T07:22:59Z")

</div>

@anon39940173 Thanks for your answer.  
This is the solution we had found and it’s working great now.  
As you stated, though, I’m afraid using these ‘private’ methods will probably create other issues in the future so if you come up with better solutions later (like adding a parameter to `smartAction()` to check or not the scopes, or being able to give the scope checker methods as parameters…), please tell us 🙏 !

---

<div class="post-metadata">

**Author:** ![anon39940173](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@anon39940173](https://community.forestadmin.com/u/anon39940173)\
**Post date:** [July 28, 2021, 7:31am UTC](https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996/4 "2021-07-28T07:31:07Z")

</div>

On the long term, the architecture of those packages should change towards a more modular architecture which should fix those limitations (no timeline yet though)

---

<div class="post-metadata">

**Author:** ![benwhite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/benwhite/32/1535_2.png) [@benwhite](https://community.forestadmin.com/u/benwhite)\
**Post date:** [September 7, 2021, 11:00am UTC](https://community.forestadmin.com/t/smart-actions-not-working-anymore-after-upgrade-to-v8/2996/5 "2021-09-07T11:00:01Z")

</div>

Hi there. Is there any update on this? We have the same issue regarding smartActions on smart collections (i.e. where the backend is a REST API instead of a DB). We can go with the workaround as proposed but would be great to hear if there is a long term solution coming up
