No permissions for GLOBAL_WRITE to upgrade a user on Dexie Cloud from eval to prod

[felixangell]

Hey folks,

I don't seem to have 'GLOBAL_WRITE' on my scopes for my Dexie Cloud user. I've come to this conclusion from trying to make a new client with this scope specified:

 npx dexie-cloud authorize <EMAIL GOES HERE> --scopes GLOBAL_WRITE, ACCESS_DB
Authorizing <EMAIL GOES HERE> for <DB_LINK>
**Error 403: Cannot authorize scopes that current client doesn't have**

If I remove GLOBAL_WRITE this works. Though I can't verify all the scopes as they are truncated when I list clients on the command for my primary client/user.

This appears to be a blocker for me as my webhook to upgrade the account type is being rejected with the following error message: Not authorized to add or update users [object Object]

I'm generating a token as follows:

const tokenResponse = await fetch(`${DB_URL}/token`, {
        method: "POST",
        headers: {
            "Content-Type": "application/json",
            "Accept": "application/json",
        },
        credentials: "include",
        body: JSON.stringify({
            grant_type: "client_credentials",
            scopes: ["ACCESS_DB", "GLOBAL_WRITE"],
            client_id: 'foo',
            client_secret: 'bar',
        })
    });

client_id and client_secret are the same as the one I'm using on the CLI. This is the code I use to upgrade the customer:

const dexieResponse = await fetch(`${DB_URL}/users`, {
        method: 'POST',
        headers: {
            'Authorization': `Bearer ${tokenBody.accessToken}`,
            'Content-Type': 'application/json'
        },
        credentials: 'include',
        body: JSON.stringify([
            {
                userId: user_email,
                type: "prod",
            }
        ])
    });

Anyone have any ideas what I am doing wrong here? Thank you!

[dfahlander]

How did you retrieve your client ID and secret? Was the database owner authorizing you with limited scopes? If so, request new authorization from the one that created the database.

When creating a brand new database, you receive a clientID and secret into your dexie-cloud.key file that has all the scopes including GLOBAL_WRITE but it is possible to create new clients using npx dexie-cloud authorize <email> --scopes <comma-delimited list of scopes>

[felixangell]

Hey, the client ID + secret are the same as the one I created when I first made the DB. I have only used one single client. Hence when I tried to authorize a new client with the GLOBAL_WRITE scope it does not work as, for some reason, my primary/first client does not have this access

[dfahlander]

Ok, I think there might be two different problems:

All the scopes ACCESS_DB, GLOBAL_WRITE and also GLOBAL_READ need to be specified for the users API. So try to add "GLOBAL_READ" in the token request.

The reason npx dexie-cloud authorize <EMAIL GOES HERE> --scopes GLOBAL_WRITE, ACCESS_DB failed might be due to the space between "GLOBAL_WRITE," and "ACCESS_DB". For some reason, the system interprets it as ["GLOBAL_WRITE", ""] and it refuses the empty scope.

NOTE: API docs was not complete in this regard but I have now updated it to reflect the requirements of GLOBAL_READ together with GLOBAL_WRITE. Thanks for bringing it up so I could fix the docs.