Data Source access and permission errors

Why a data source read, write, update or delete is refused, how to confirm which rule or permission causes it, and how to fix it.

A refused data source request shows You are not allowed to read this data. in published software, or a message naming the security rules in Studio preview. This page shows how to find the cause and fix it.

It applies to Fliplet Studio, Studio preview, published web and native software, and Fliplet JavaScript SDK and API token requests. You need access to the project's data sources.

What you see

Published software shows the short message, with the refused operation in it:

You are not allowed to read this data.

Studio preview shows the long message, with the data source name in it:

The security rules for the Data Source "Employees" do not allow this app to read data.

The wording depends on who made the request. Published software runs on an app token, and app token requests get the short message. A Studio user in preview gets the long one, with the type datasource.access and the data source ID in the payload.

The operation word in both messages is read, write, update or delete.

A refused list read, single entry read or single entry delete returns HTTP status 400. A refused write or update of a single entry returns 401. The JSON body's message holds the text. In custom code, Fliplet.parseError(error) turns the error object into that text.

When code passes the long message's error to Fliplet.UI.Toast.error, the toast has an action labeled Edit rules [UNVERIFIED: Studio UI, label "Edit rules" is from code only] that opens the data source's security rules.

Other messages point to a specific cause:

Message	Go to
`Your role does not allow reading from this data source.`	A Studio user's role limits them
`Your role does not allow writing to this data source.`	A Studio user's role limits them
`Your role does not allow updating this data source.`	A Studio user's role limits them
`Your role does not allow deleting entries from data source.`	A Studio user's role limits them
`Your role does not allow advanced querying from this data source.`	A Studio user's role limits them
`Query not allowed.`	A Studio user's role limits them
`The query is not allowed`	A Studio user's role limits them
`A security rule has returned the following error:` and the error	A custom rule refused or failed
`The Data Source Employees has not been found.`	The data source can't be found
`You need to log in to read comments.`	The entry belongs to someone else
`You cannot update this entry as it belongs to a different user.`	The entry belongs to someone else
`You cannot delete this entry as it belongs to a different user.`	The entry belongs to someone else
`Comments can only be updated by the user who posted them.`	The entry belongs to someone else

[UNVERIFIED: Studio UI, every message on this page is quoted from code because no refused request was made]

Quick checks

Note the exact message, the operation word, and whether it happened in preview or in published software.
In the project editor's top bar, hover over the wrench icon to see Enforce security.
Compare the action in the project editor's preview with Enforce security on and off.
Open Data Sources in the project sidebar.
Open the data source.
Select Security rules.

If the action works with Enforce security off and fails with it on, the rules are the cause. With it off, the preview skips the rules for a Studio user. Use the project editor's preview for this check, because a preview URL with interact=true skips the rules even with security on.

Rules are also skipped for Studio users outside preview. Data you can see in the Data Sources panel doesn't show what your users can reach.

A rule counts for a request only when all of these are true:

The rule is enabled.
Applies to includes the project.
Users can includes the operation.

A custom JavaScript rule is checked for every operation. One rule granting the request is enough: the request is refused only when no rule grants it.

Causes and fixes

After you change a rule, select Confirm, then save the rule list with Save & Apply [UNVERIFIED: Studio UI, label "Save & Apply" shows after a rule change and is from code only].

No rule is turned on

A data source created from the Data Sources panel starts with no rules, and an empty rule list refuses every request. Rules that are turned off are ignored, so a list where every rule is off refuses every request too.

Confirm it: On Security rules, the table is empty, or no rule's Status shows Enabled. An empty list shows No security rules found and Apps will not be able to access this data source until security rules are added. [UNVERIFIED: Studio UI, empty list text is from code only]

Fix it:

If a rule exists but is off, turn its Status toggle on.
If no rule exists, select Add new rule.
Choose a pre-configured rule, or select Create my own rule.
Save the rule list.

No rule covers this operation

The operation in the message must be ticked under Users can in a rule that applies. Read, Write, Update and Delete are separate, so a rule with Write doesn't allow updates. The word write in a message means adding a new entry.

Confirm it: Read the Users can column of each enabled rule.

Fix it:

Select Edit on the rule.
Tick the operation.
Select Confirm.
Save the rule list.

The rule applies to other projects

A rule limited to specific projects only matches requests from those projects.

Confirm it: The Applies to column shows other projects instead of All projects.

Fix it: Select Edit on the rule, change Applies to, then save the rule list.

The user isn't signed in, or the wrong user is

A Logged in users rule needs a login in the session. A Specific users rule compares the signed-in user's own columns with the rule's conditions, so it doesn't grant anything with no login. Text comparisons that use equals ignore case.

A rule can be bound to specific login data sources. Only a login from one of those counts, and a login from another data source doesn't satisfy it. [UNVERIFIED: Studio UI, how a bound rule appears in the rules table wasn't seen]

In Studio preview, a login counts if it's bound to the previewed project, comes from a shared login data source in the project's organization, or comes from a login data source of another project in the same organization that this project uses. Any other login doesn't count.

Confirm it: Repeat the action in preview with Enforce security on, signed in as that user. To test signed out, hover over the wrench icon and select Clear next to Reset session, which clears cookies, storage, and sessions.

Fix it: Sign in first, or select Edit on the rule and change Allow, then save the rule list.

The request doesn't meet a data requirement

Every condition under Request data requirements must pass, or the rule doesn't grant the request.

A required field must be in the query or in every submitted entry.
A condition that refers to the user fails when that user value is empty or missing.
For an update, a condition is checked against the stored record, not only against what the request sends.

Confirm it: Compare the Request data requirements column with the query or entry that was sent.

Fix it: Send the required field or value, or select Edit on the rule and change the requirement, then save the rule list.

A custom rule refused or failed

A custom rule grants a request only when its script returns an object with granted: true. Scripts have a 3 second timeout. A script that throws produces A security rule has returned the following error: and the error, when no other rule grants the request.

Confirm it: When the script throws, the message names the script's error. When you get the ordinary refusal instead, read the script and check that it returns granted: true for this operation and user.

Fix it: Select Edit on the rule, correct the script, then save the rule list. [UNVERIFIED: Studio UI, a custom rule's row and edit dialog weren't seen]

An API token isn't allowed

A Specific token rule grants requests only to the tokens it lists.

Confirm it: Read the token ID and name in the Allow column, and compare them with the token making the request. [UNVERIFIED: Studio UI, where to find your own token's ID wasn't checked]

Fix it: Add a rule for that token, or select Edit on the rule and change Allow, then save the rule list.

A Studio user's role limits them

Messages that start Your role does not allow, plus Query not allowed. and The query is not allowed, come from the permissions or query limits on a user's data source role. Security rules don't cause them.

A user with no permission entry has crudq. The letters mean:

Letter	Allows
`c`	Write entries
`r`	Read
`u`	Update
`d`	Delete
`q`	Advanced querying

Confirm it: On the data source, select Studio user permissions and read the Permissions column. A role's query limits aren't in that column, so a user showing crudq can still be limited.

Fix it: Send support the message, the user, and the row from that tab. [UNVERIFIED: Studio UI, how to change an existing role or its query limits wasn't confirmed]

The data source can't be found

The Data Source Employees has not been found. comes with HTTP status 404. It means the caller can't see the data source. The ID or name may be wrong, or the data source may not be linked to the project.

Confirm it: Open Data Sources, find the data source, and check its ID and Used by projects columns.

Fix it: Use the correct ID or name in the code or component. If the data source belongs to another project, send support the details. [UNVERIFIED: no Studio screen for linking a data source to a project was found]

The entry belongs to someone else

Bookmarks, likes, and comments data sources are managed by the system, so you can't add rules for them in the panel. They show Security for this data source is managed by the system. [UNVERIFIED: Studio UI, managed data source text is from code only]

A user can only delete or update their own bookmarks and likes. Only the user who posted a comment can update it, and delete is limited to the owner when owner rules are on. Reading comments needs a login.

Confirm it: The message names ownership or login.

Fix it: Sign in as the user who owns the entry.

A column is missing but there's no error

Include or exclude columns on the rule that granted the request removes columns from what's read, and that isn't an error. On a write or update, excluded fields are dropped from the data.

Confirm it: Read the Columns column of each enabled rule that applies to this user.

Fix it: Select Edit on the rule and change its columns, then save the rule list.

Check the fix worked

Turn Enforce security on.
Repeat the action in the project editor's preview as the same user.
Repeat the action in the published software.

Rules are stored on the data source and read for each request, so a saved rule doesn't need the project to be republished. Preview shows the long message if the request is still refused, and published software shows the short one.

What to send support

Use Support chat in Studio, or see Contact Fliplet Support. Send:

The exact message and the operation
The data source ID from the ID column
The project name
Whether it happened in preview or in published software
The time it happened
How the user signs in
Whether it works with Enforce security off