https://linen.dev logo
Join Slack
Powered by
Hi, I'm wondering if the List Role Assignments loc...
# permit-saas
e
Hi, I'm wondering if the List Role Assignments local query changed recently: https://pdp-api.permit.io/redoc#tag/Local-Queries/operation/list_role_assignments_local_role_assignments_get Previously this would return a complete list of a user's permissions, but now the list is missing entries.
a
Hi @Elias Cooper, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
a
The List Role Assignments local query returns role assignments from the local PDP, and the function is paginated with a maximum of 100 role assignments per page (1) . You can use the 
page
and 
per_page
parameters to navigate through the pages . The response schema for role assignments includes :
Copy code
[  
 {  
 "user": "<mailto:jane@coolcompany.com|jane@coolcompany.com>",  
 "role": "admin",  
 "tenant": "stripe-inc"  
 },  

 {  
 "user": "<mailto:jane@coolcompany.com|jane@coolcompany.com>",  
 "role": "admin",  
 "tenant": "stripe-inc",  
 "resource_instance": "document:doc-1234"  
 }  
]
If you're seeing missing entries, this could be due to pagination limits. The API returns a maximum of 100 role assignments per page , so you may need to paginate through multiple pages to get the complete list. To help our engineers investigate this issue further, could you please provide: 1. Which Workspace / Project / Env you are using 2. What calls you are performing (as SDK code or CURL) 3. Which PDP version you are running 4. Any relevant logs from your PDP This information will help us determine if there's a specific issue with your setup or if you're encountering the pagination limit.
To learn more, see the sources I considered: [[1] Local Enforcement APIs](https://docs.permit.io/how-to/enforce-permissions/list-role-assignments)
e
The user I'm querying has 15 role assignments. The issue is not pagination.
I am running a Next.JS app and using the PDP endpoint in my middleware. The call is made like this: 
const response = await fetch(
``${process.env.PERMITIO_PDP}/local/role_assignments?user=${normalizedUser.key}`,` 
{
method: "GET",
headers: {
`Authorization: 
Bearer ${process.env.PERMITIO_API_KEY}
,` 
"Content-Type": "application/json",
Accept: "application/json",
},
}
)
I know for a fact that this is working -- roles are being returned. Only now they're missing my Admins for some reason. For what it's worth, when using the SDK, the Admin role is returned: 
public async getUserRoles(email: string, role?: string) {
const permit = this.permitContainer.getPermit()
if (role) {
return await permit.api.roleAssignments.list({ user: email, role })
}
return await permit.api.roleAssignments.list({ user: email })
}
PDP Logs provided below.
n
Hi @Elias Cooper thanks for reaching out. Let me check with our team and we will get back to you. In the meantime, I'm tagging @Ask Inkeep
e
PDP Logs.txt
PDP Logs.txt
a
Thanks for tagging me @Natalia Edelson. I'll look through relevant sources and get back to you shortly.
e
Container image: permitio/pdp-v2:0.8.1
@Natalia Edelson - thank you!
a
Thank you for the detailed information. Since you're seeing inconsistent results between the local PDP endpoint and the SDK API calls, this appears to be a specific issue with your PDP's data synchronization. The List Role Assignments function is available from PDP container version 
permitio/pdp-v2:0.3.0
and above (1) . The function accepts optional filters including 
user_key
, 
tenant_key
, 
role_key
, and 
resource_instance_key
. To help our engineers investigate why Admin roles are missing from your PDP's local query results: 1. ​*Which Workspace / Project / Env are you using?*​ 2. ​*What specific PDP version are you running?*​ (You can check with 
docker ps
to see the exact image version) 3. ​*Could you share the relevant PDP logs?*​ (You mentioned you have logs - these would be crucial for debugging) 4. ​*What exact SDK calls are working correctly?*​ (The code you shared helps, but knowing the exact response differences would be valuable) The discrepancy between the SDK API call (which returns Admins) and the local PDP query (which doesn't) suggests a potential sync issue between your PDP and the Permit.io control plane. The PDP should have the same data as what's returned via the SDK's API calls.
To learn more, see the sources I considered: [[1] Local Enforcement APIs](https://docs.permit.io/how-to/enforce-permissions/list-role-assignments)
e
@Ask Inkeep - Here is the response from the SDK call, i.e. permit.api.roleAssignments.list: 🚀 ~ Page ~ userRoles: [ { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2931 }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2930 }, { contactId: 8629, role: 'Owner', resource_instance: 'ProjectGroup', resourceId: 2834 }, { contactId: 8629, role: 'Owner', resource_instance: 'ProjectGroup', resourceId: 2830 }, { contactId: 8629, role: 'Owner', resource_instance: 'ProjectGroup', resourceId: 2833 }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2927 }, { contactId: 8629, role: 'Owner', resource_instance: 'ProjectGroup', resourceId: 2832 }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2924 }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2925 }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2926 }, { contactId: 8629, role: 'Admin', resource_instance: 'OPUS', resourceId: NaN }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2923 }, { contactId: 8629, role: 'Owner', resource_instance: 'Project', resourceId: 2921 } ] And here's the results from the PDP fetch call: ~ authorize ~ roles: [ { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2921' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2923' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2924' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2925' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2926' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2927' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2930' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'Project:2931' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'ProjectGroup:2830' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'ProjectGroup:2832' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'ProjectGroup:2833' }, { user: 'eliascooper@goaztech.com', role: 'Owner', tenant: 'default', resource_instance: 'ProjectGroup:2834' } ] Previously, this latter call included the 'Admin' role.
a
Thanks for tagging me @Elias Cooper. I'll look through relevant sources and get back to you shortly.
Thank you for providing the detailed comparison. I can see the clear discrepancy - the SDK call returns 13 role assignments including the critical 
Admin
role for the 
OPUS
resource, while the PDP local endpoint only returns 12 assignments, missing that Admin role entirely. This appears to be a data synchronization issue between your PDP (v0.8.1) and the Permit.io control plane. The PDP's local datastore may not have the complete role assignment data. Based on your setup, here are a few things to check: 1. ​*FactDB Configuration*​: If you're using FactDB (1) , ensure it's properly enabled both in your environment settings and on the PDP with 
PDP_FACTDB_ENABLED=true
. 2. ​*PDP Data Sync*​: The PDP should automatically sync with the control plane. Check if there are any sync errors in your PDP logs that might explain why the Admin role isn't being stored locally. To help our engineers investigate this regression (since you mentioned it previously worked) : 1. ​*Which Workspace / Project / Env are you using?*​ 2. ​*Exact PDP version*​: You mentioned 
permitio/pdp-v2:0.8.1
- can you confirm this is correct? 3. ​*PDP logs*​: Please share the relevant PDP logs, especially any sync or data update messages 4. ​*When did this stop working?*​ Any recent changes to your setup? The fact that the SDK API call returns the correct data but the local PDP query doesn't strongly suggests the PDP's local cache is incomplete. This could be related to how the 
OPUS
resource instance is being synchronized to the PDP.
To learn more, see the sources I considered: [[1] Local Datastore (FactDB)](https://docs.permit.io/concepts/pdp/factdb)
e
@Ask Inkeep - I'm not using FactDB. I don't see a PDP Data Sync error in the logs, though there are errors. See attached. PDP Container Image in Azure is noted as permitio/pdp-v2:0.8.1 Hard to say when this stopped working. The last month, maybe?
PDP Logs.txt
a
Thanks for tagging me @Elias Cooper. I'll look through relevant sources and get back to you shortly.
Thank you for confirming those details. Since you're not using FactDB and the issue has been occurring for about a month, this appears to be a synchronization issue between your PDP's local data and the Permit.io control plane. The PDP uses OPAL (Open Policy Administration Layer) to stream policy and data updates in real-time (1) . When there's a discrepancy between SDK API calls (which query the control plane directly) and local PDP queries, it typically indicates the PDP isn't receiving or processing all data updates properly. Based on the PDP configuration options (2) , here are some relevant settings to check: • `PDP_CONTROL_PLANE_TIMEOUT`: Default is 75 seconds • `OPAL_FETCHING_CALLBACK_TIMEOUT`: Controls callback timeout for data fetching • `PDP_OPA_CLIENT_QUERY_TIMEOUT`: Default is 1 second for OPA queries To help our engineers investigate why the Admin role for the OPUS resource isn't syncing to your PDP: 1. ​*Which Workspace / Project / Env are you using?*​ 2. ​*What specific error messages are you seeing in the PDP logs?*​ (You mentioned there are errors - these would be crucial) 3. ​*Your confirmed PDP version*​: permitio/pdp-v2:0.8.1 4. ​*Please share the relevant PDP logs*​, particularly any OPAL sync messages or data update errors The missing Admin role assignment specifically for the OPUS resource instance suggests there might be an issue with how that particular resource type or tenant-less role assignment is being synchronized to the PDP's local store.
To learn more, see the sources I considered: [[1] Concepts / Glossary](https://docs.permit.io/overview/glossary) [[2] Configurations](https://docs.permit.io/concepts/pdp/configuration)
e
The one env var I have of the ones listed is: PDP_OPA_CLIENT_QUERY_TIMEOUT. Which is set to 0.
The reason I don't think it has to do with sync is that the Admin role was established at the same time as the various Owner roles, all by a seed script.
a
Hey @Elias Cooper, let me try to reproduce this and I'll get back with you.
❤️ 1
👀 1
t
@Alon Boshi I worked with @Elias Cooper and the issue was that part of the data from Permit was not in the PDP at all. He did a restart and the data showed up, and he's in the process of upgrading to the 
latest
so that if it happens again we'll be able to adress the issue better. @Elias Cooper keep us posted if you run into this issue again.
Open in Slack
PreviousNext
Powered by