---
# System prepended metadata

title: PEP - Error Management - Issues

---

# PEP - Error Management - Issues

#### List of things not found(or could not trigger) in Connect/Admin
* (“SearchType”, [“List”, “Read”])
* (“Media”, [“Create”, “Update”, “Delete”])
* (“SearchHistoryResult”, [“Read” ])
* (“File”, ["Create", “IMPORT_METADATA_FILE”, “CONFORM”, “CREATE_THUMBNAIL”, “REVERSE_TRANSCODE”, "ImportTrackTags"])
* (“Package”, [“Execute” ])
* (“Workflow”, [“SWF_Signal” ])
* (“User”, [“SetSysAdmin” ])
* ("Entity",[""]) / All
* (“MetadataTemplate”, [“GenerateEntityContext” ])

---

1. [name=Cristina Petre] [FE] ***Failed to fetch*** for dashboard charts (deny rule for list titles)
[deny list titles - dashboard chart](https://i.imgur.com/UKVe908.png)
- [x] DEV
- [x] QA - Fixed


2. [FE] **Could not fetch the list of generated files.** when denying List, Read for Workflow on:
    *  Workbench tab of a file.
    *  CPL Editor Slate tab

```
deny[msg] {
    utils.is_type_multiaction("Workflow", ["Read", "List"])
    
    msg := "No Read/List WF"
}
```
[Image1](https://i.imgur.com/ifnL1Uu.png)
[Image2](https://i.imgur.com/XDV6GoO.png)

- [x] DEV
- [x] QA - Fixed

3. [FE] **Could not fetch workflow** when denying List, Read for Workflow on:
    *  Technical Details tab of a file.
    *  [Package page](https://connect.asgard.ownzones.dev/asgard/packages/b982214e-4df9-43af-97fb-a5b8cb0a6692) (Deliveries, Auto QC, Package WF)
    *  [Job page](https://connect.asgard.ownzones.dev/asgard/jobs/c7eb7a25-ea5e-4d04-916d-95882116d2c2) (Progress Details, Preview Details for a Package, )

```
deny[msg] {
    utils.is_type_multiaction("Workflow", ["Read", "List"])
    
    msg := "No Read/List WF"
}
```
[Image1](https://i.imgur.com/XFfuqPQ.png)
[Image2](https://i.imgur.com/aUKy6n8.png)
[Image3](https://i.imgur.com/la0W7Xj.png)

- [x] DEV
- [x] QA - Fixed

4. [FE] Errors when denying List, Read for Workflow on Deep Analysis tab of a [file](https://connect.asgard.ownzones.dev/asgard/files/234b9a07-bb1e-431c-919a-89481713a791?tab=deepAnalysis) and after starting a new DA:
    * GraphQL errors in ReadScanStatus!
    * GraphQL errors in ListAllScans!
    * GraphQL errors in ReadScanWorkflow!

```
deny[msg] {
    utils.is_type_multiaction("Workflow", ["Read", "List"])
    
    msg := "No Read/List WF"
}
```
[Image1](https://i.imgur.com/zvkk24T.png)


- [x] DEV
- [ ] QA - Still Present. For Future us.

5. [BE/FE] Graphql Error in console and normal Red error message are present when trying to **Update** a task through **TaskServiceTaskType** with the following steps:
a) Go to Tasks from left-side bar
b) Select a Task and open it
c) Enter the deny policy for Update on that user and wait for the changes to be made:

```
deny[msg] {
  utils.is_type_action("TaskServiceTaskType", "Update")
  
  msg := "Sorry user, you cannot Update!"
}
```
 d) Modify anything on the task (e.g. Name, Description, etc.)
 e) Press Save
 
This will occur: 
[Image1](https://i.imgur.com/MA7VUE7.png)


- [x] DEV
- [x] QA

6. GraphQL errors in ListUsers! - Cannot query field "totalCount" on type "UserConnection". [Image](https://i.imgur.com/MULG16j.png)
This error occurs from time to time, on the Users/Permissions tab or Roles page while logged in with default sysAdmin user. Tried clearing cache/cookies but still re-appeared. Note that after a refresh, the list loads normally.
- [x] DEV
- [x] QA - Has not occured recently


**Due to deprecated code I guess. Should be fine after a new deploy**

7. **[P1]**[FE] "There was a problem fetching data" and GraphQl errors in console when trying to acces any task from the list with the policy that denies permission for "**List**" action in "**TaskServiceMediaItemType**". 
Note: This occurs even if there is no media item attached to a task.
Note2: For any other actions (e.g. Delete, Update), the deny will not work and the user can use that action.

[Image1](https://i.imgur.com/IM7xGGE.png)

- [ ] DEV
- [ ] QA - Still Present. Abalan to investigate


8. [FE] Could not fetch error when trying to Deny Permission for Annotation with List action
```
deny[msg] {
  utils.is_type_action("Annotation", "List")
  
  msg := "Sorry user, you cannot List!"
}
```
[Image](https://i.imgur.com/qYS7mrk.png)


- [x] DEV
- [x] QA - Fixed


9. [BE] Unauthorized message in FE (in Batch History expansion area) and GraphQL errors in console when trying to deny **Read** Permission for **AuditLogs**. Also, batch details on the left side of the screen is still visible(should it be?):
```
deny[msg] {
  utils.is_type_action("AuditLogs", "Read")
  
  msg := "Sorry user, you cannot Read!"
}
```
[Image](https://i.imgur.com/3xXUk4f.png)

***BE is sending INTERNAL_SERVER_ERROR. FE Works as expected***

- [x] DEV
- [ ] QA - Still Present. Appears to be BE problem so adding the tag

10. [BE] No message received when trying to update Audio Track language when denying permission for **Update** action on **AudioTrack**:
```
deny[msg] {
  utils.is_type_action("AudioTrack", "Update")
  
  msg := "Sorry user, you cannot Update!"
}
```
[Image](https://i.imgur.com/EYcfV8T.png)

**Permission check is triggered only when the `Layout` is changed**
**BE Related**

- [x] DEV
- [ ] QA - Partly Fixed. The user has the Deny message when changing the layout. He will not have a deny message present when trying to change the audio track language. 
**Needs ticket for BE**

11. **[P1]**[FE/BE] Update Transcoder Profile is thrown on profile page, before trying to edit it. Update action should be activated when actually trying to update the profile, not when trying to view it. This way an user with no update right, can't view the profile created early(assuming he has create right).
**Same thing happens for Titles.**
**Same thing happens for TimedTextProfiles.**
**Same thing happens for Organizations.**

[Image1](https://i.imgur.com/umTIKPe.png)
- [ ] DEV
- [x] QA - Fixed

12. [FE] Transcoder Profile Tools:
* GraphQL errors in ExportTranscoderProfile! - instrument.js:109 Action Export on type TranscoderProfile is not allowed - This happens in org settings Tools when Export action is denied.
* GraphQL errors in ListTranscoderProfiles! - instrument.js:109 Action List on type TranscoderProfile is not allowed - This happens in org settings Tools when Export is allowed, but List, Create, Update are denied.

- [x] DEV
- [x] QA - Fixed. Export option does not appear on the page but there is no deny message. When List, Create and Update are denied, the Export option will appear but the user will receive a Deny message after pressing the Export button.
**Working as intended**

13. **[Improvement - P2]**[BE] Denying List action on VirtualFolder, still displays virtual folders on a Title.
```
deny[msg] {
    utils.is_type_multiaction("VirtualFolder", ["List", "Read", "Create", "Update", "Delete"])
    
    msg := "Zero access to virtual folders"
}
```
- [ ] DEV
- [ ] QA

14. [same as 13] [FE]GraphQL errors in ReadVirtualFolders! - instrument.js:109 Action List on type VirtualFolder is not allowed - This happens on a Virtual Folder "page" when Read action is denied.
- [ ] DEV
- [ ] QA

15. **[P2]**[BE]Update action for Virtual Folder is possible even if it is denied although the toast is correctly displayed.
Steps:
* while having denied the update action go to Update Folder from the 3-dot menu
* in the modal that opens, choose a file from the virtual folder and press save
* observe that the toast is correctly displayed
* but if you close the modal and go to the actual virtual folder you can observe that the file is not there anymore.
[Image1](https://i.imgur.com/3GsiQOd.png)
- [ ] DEV
- [ ] QA

16. **[P1]**[FE] Titles:
* On media items page, media item preview, batches, jobs errors in TitleIdentity and AutoCompleteTitles [Image1](https://i.imgur.com/2qUxDCy.png) - when denying Read action
- [ ] DEV
- [x] QA - Fixed

17. [FE] Could not fetch clip details error when pressing the Edit option on a Clip while trying to deny **Read** permission for **Clip**:
```
deny[msg] {
  utils.is_type_action("Clip", "Read")
  
  msg := "Sorry user, you cannot Read!"
}
```
[Image](https://i.imgur.com/HweuXHC.png)

- [x] DEV
- [x] QA - Fixed

18. [FE] not allowed / something went wrong errors when denying permission for **Demux** to **Read** and **Execute**:
```
deny[msg] {
  utils.is_type_action("Demux", "Read")
  
  msg := "Sorry user, you cannot Read!"
}
```
```
deny[msg] {
  utils.is_type_action("Demux", "Execute")
  
  msg := "Sorry user, you cannot Execute!"
}
```

[Read](https://i.imgur.com/QADiqI7.png)
[Execute](https://i.imgur.com/hrX3ws1.png)

- [x] DEV
- [x] QA - Fixed

19.**[Improvement - P2]**[BE] Import IMF works when Import_IMF Action is denied for Titles

```
deny[msg] {
    utils.is_type_multiaction("Title", ["Import_IMF"])
    
    msg := "Zero access to Titles"
}
```
- [ ] DEV
- [ ] QA

20. **[P1]**[FE] TimedText Profile:
* GraphQL errors in ListProfiles! Action List on type TimedTextProfile is not allowed - when denying List for TimedTextProfile in Workbench TT [Image1](https://i.imgur.com/h0trShR.png)
* GraphQL errors in ReadOptions! instrument.js:109 Action List on type TimedTextProfile is not allowed - when denying List for TimedTextProfile on Package Template page [Image2](https://i.imgur.com/MDzZXuY.png)
- [ ] DEV
- [x] QA - Fixed

21. **[Improvement - P2]**[BE] User can select Timed Text Profile in Package Template, even if Read action is denied and no error is thrown. User should see something similar to Workbench TT case: [Image1](https://i.imgur.com/OZzYpIC.png)
- [ ] DEV
- [ ] QA

22. [expected][BE] The user can ingest a file via a different process, other than Add Media Item - e.g. Media Warp. The output file will be completely ingested in Connect even if the user has deny policy for **File** with action **Ingest**:
```
deny[msg] {
  utils.is_type_action("File", "Ingest")
  
  msg := "Sorry user, you cannot Ingest!"
}
```

- [ ] DEV
- [x] QA - Intended behavior, no action required

23. [FE] Action not allowed + GraphQl error when the user tries the **Create** action for a **FileDelivery**:
```
deny[msg] {
  utils.is_type_action("FileDelivery", "Create")
  
  msg := "Sorry user, you cannot Create!"
}
```
[Create](https://i.imgur.com/3V5wOOW.png)
- [x] DEV
- [x] QA - Fixed

24. [retest][BE] Plugins are still displayed in left side menu and top bar after denying List and Read Actions.
Top bar plugin still return data even if Read action is denied.
Plugins are no longer visible in org settings, Integrations tab.

***type Plugin - for settings
type PluginsPage | List - for menu, top bar***
```
deny[msg] {
    utils.is_type_multiaction("Plugin", ["List", "Read", "Create"])
    
    msg := "No access to Plugins"
}
```
- [ ] DEV
- [x] QA - Fixed. PluginsPage is the actual type

25. [FE] Action not allowed + GraphQl error encountered when the user tries to run **Transcode** action on **Package**:
```
deny[msg] {
  utils.is_type_action("Package", "Transcode")
  
  msg := "Sorry user, you cannot Create!"
}
```
- [x] DEV
- [x] QA


26. [same as above,P2][BE] Import IMF Package feature works even if it denied from policy:

Steps:
a. Add following rule to policy, assign it to an user
```
deny[msg] {
    utils.is_type_multiaction("Package", ["ImportPackage"])
    
    msg := "No access to Import IMF PKG"
}
```
b. log in with the user and try to import an imf package
c. observe that the package can be imported
- [ ] DEV
- [ ] QA

27. [FE] GraphQL errors in runAutoQC! instrument.js:109 Action Execute on type AutoQC is not allowed - when denying Execute for AutoQC [Image1](https://i.imgur.com/cVN91IT.png)
- [x] DEV
- [x] QA - Fixed


28. [retest with correct type+actions][BE] FilePreviewUrl and FileDownloadUrl still work even if they are denied in the user policy.

***File | Preview, Download***

```
deny[msg] {
    utils.is_type_multiaction("FilePreviewUrl", ["Read"])
    
    msg := "No access to FilePreviewUrl"
}
deny[msg] {
    utils.is_type_multiaction("FileDownloadUrl", ["Read"])
    
    msg := "No access to FileDownloadUrl"
}
```
- [ ] DEV
- [x] QA - Fixed. Deny policy works with File - Download and Preview

29. **[P1]**[FE/BE] Denying permission for **NotificationUserSettingsType** with action type **Read** will make the Turn notifications on/off button return no pop-up message. GraphQl errors will show up in the console letting the user know he can not apply the **Read** action: 
```
deny[msg] {
  utils.is_type_action("NotificationUserSettingsType", "Read")
  
  msg := "Sorry user, you cannot Read!"
}
```

- [ ] DEV
- [x] QA - Fixed

30. [retest][FE/BE] Update/Disable ApiKeys not being denied, user can still disable api keys while using the following policy.

***ApiKeys | List, Create, Disable***
```
deny[msg] {
    utils.is_type_multiaction("ApiKeys", ["DisableApiKeys"])
    
    msg := "No access to ApiKeys"
}
```
```
deny[msg] {
    utils.is_type_multiaction("ApiKeys", ["Update"])
    
    msg := "No access to ApiKeys"
}
```
- [ ] DEV
- [x] QA - All good. The user has Deny toast message now when trying to create an ApiKey. When List is denied, no ApiKeys will be shown in the list (no toast message). When Disable is denied, no ApiKey Disable button is present (no toast message).

31. **[P1]**[FE] Organization:
* GraphQL errors in ReadCurrentUser!Action Read on type Organization is not allowed - page level access error should be used, right now user only sees an empty page.
* User can't view an organization if Update action is denied [Image1](https://i.imgur.com/PSOrOX0.png)

- [ ] DEV
- [x] QA - Fixed

32. [retest][FE] No toast message when denying permission for **MetadataTemplate** to perform the **Preview** action:
deny[msg] {
  utils.is_type_action("MetadataTemplate", "Preview")
  
  msg := "Sorry user, you cannot Preview!"
}

**Is this a valid rule? I can not set (Could not parse given Rego input)**

- [ ] DEV
- [x] QA - Still Present.

33. [FE] User:
**[P1]** GraphQL errors in ReadCurrentUser!instrument.js:109 Action Read on type User is not allowed - implement level page access error, right now user can only see an empty page
- [ ] DEV
- [x] QA - Still Present


**[P1]** deny List on Type User, in org settings, Users tab needs component access level error
- [ ] DEV
- [x] QA - Fixed. The users are not listed, but there is no Deny error message
**Works as intended**


**[P1]** [403](https://i.imgur.com/HDsgI5U.png) page is displayed for user with Deny on [ListSysUsers](https://connect.asgard.ownzones.dev/admin/sys-admins), level page access error should be implemented
- [ ] DEV
- [ ] QA - Still Present. 403 error "You don't have permission to access this page" present when trying to access the page

**[P1]** GraphQL errors in ResetToken!instrument.js:109 Action ResetToken on type User is not allowed - implement new toast message for user with Deny on ResetToken [Image](https://i.imgur.com/aBaQqw6.png)
- [ ] DEV
- [x] QA - Fixed. Deny message also added now to let the user know that the right to reset the token is denied.
* not sure how to reproduce **SetSysAdmin**?


34. [FE/BE] Denying **Read** rights for **ImageSequenceFrameProperties** will make the Image Sequence appear like it hasn't had the Frame Rate Setup. When the user tries to set a new Frame Rate for the Image Sequence and press Save, only then will he receive the popup that **Read** is denied:
```
deny[msg] {
  utils.is_type_action("ImageSequenceFrameProperties", "Read")
  
  msg := "Sorry user, you cannot Read!"
}
```
[Read1](https://i.imgur.com/EYjlr6R.png)
[Read2](https://i.imgur.com/fo5O3x1.png)

- [x] DEV
- [x] QA - Fixed. Deny message now present in Props area when Read is denied (When the autorefresh action from the area activates, the user can see the details for only a moment).

35. **[P1]**[FE] When the user denies **List** action for **Entity** error will be noticed in console, no toast message appears and the dropdown is not populated (which is unintuitive for the user to understand that he doesn't have list permission for that area).

```
deny[msg] {
  utils.is_type_action("Entity", "List")
  
  msg := "Sorry user, you cannot List!"
}
```
[List](https://i.imgur.com/ZlR5Mvw.png)

- [ ] DEV
- [x] QA - Fixed. Toast message opens now when the dropdown for Entity is pressed, in Metadata Sets for a Title

36. [P2][BE] Platform:
* GraphQL errors in ReadApplePlatform! instrument.js:109 Action List on type Platform is not allowed - no feedback in FE for this error.
* Using **Update** blocks the user from accessing any platform from the list, except for Apple Platform, which can still be accessed.
* Using **Read** blocks the user with the right message on any normal platform but on the Apple platform page, he gets a 403 error with the classic "you don't have access to this page" message:
[403](https://i.imgur.com/JuaYToX.png)


- [ ] DEV
- [ ] QA

37. [existing jira ticket][FE] Search:
* GraphQL errors in SearchFilters! instrument.js:109 Action Read on type SearchFilters is not allowed - no feedback in FE for this error [Image1](https://i.imgur.com/gFo4mhL.png)


- [ ] DEV
- [X] QA - Ticket already submitted for this issue

38. **[P2]**[BE] App crashes when opening an Instance while action Read is denied for type. [Image](https://i.imgur.com/q5fqD4e.png)

```
Uncaught TypeError: Cannot read properties of null (reading 'applicationId')
    at NodeDetails (index.jsx:236:78)
```
- [ ] DEV
- [ ] QA

39. **[P2]**[BE] User can update Instance when action Update is denied for type. No error is thrown in FE as well.
- [ ] DEV
- [ ] QA

40. 