V8-archive: Users cannot patch collection_presets when update permissions set to "mine"

[honzabilek4]

When collection_presets update permission is set to mine, which is by default. Regular user is unable to send PATCH request to update his record. This way it's impossible for them to customise their collection view unless the update permissions is manually set to all.

Here, you can see that the record with id 10 exists and is assigned to user with id 2, who is the currently logged in user.

System

• API: [2.0.10]
• Web Server: [Nginx 1.14.1]
• PHP Version: [eg: 7.0.32]
• Database: [eg: MySQL 5.7.24]

[benhaynes]

Thanks @honzabilek4 — we're on it!

[wellingguzman]

Also it should be noted that this also happens with any permission that needs to verify the owner of the item.

[wellingguzman]

Another thing to add here is because at the moment we can't tell what field store the owner of collection_presets, we can't properly verify the permission using mine or role. The API tries to look for a field user_created type, and this should change for another field for owner, and one case of author this can be either a new type or a fixed logic.

[rijkvanzanten]

For directus_collection_presets, we can use the user column for this purpose.