Workspace invitation API returns a 500 server error (permissions problem?)

Technical Help
, ,
1

Please fill in the questionnaire below.

Technical Help Questionnaire

Have you read and followed the instructions at: *READ ME FIRST* Technical Help FAQs - #2 by nigel ?

Answer: Yes I have

Self-Hosted Installation and Setup Questions

How have you self-hosted Baserow.

I have self-hosted Baserow with Cloudron.

What are the specs of the service or server you are using to host Baserow.

The server has a 40 GB storage capacity and 8 GB of RAM.

Which version of Baserow are you using.

I am using Baserow v1.27.1 with the Cloudron io.baserow.cloudronapp@1.22.0 package version.

How have you configured your self-hosted installation?

Installation has been done through a single click in the Cloudron UI.

What commands if any did you use to start your Baserow server?

This is Cloudron-handled.

Describe the problem

Before describing the problem, I must say that everything works good, from the APIs to the UI. There is a single API that returns a server error.

Describe, step by step, how to reproduce the error or problem you are encountering.

  • A non-authenticated user fills in a sign up form in a Nextjs application.
  • When the form is submitted, a first API call is made to create a Baserow profile and a second API call is made to add an entry with more details (including user email) in a profiles table of a dedicated workspace.
  • I receive a notification thanks to an n8n webhook that a new profile is created and needs to be invited to the workspace.
  • On the Nextjs app, I have a view listing the emails from the profiles table that do not appear in the workspace user list, with a button to send them the link using the Baserow APIs
  • I click on the button which performs the following :
- URL: https://baserow.lesoctetslibres.com/api/workspaces/invitations/workspace/34/
- POST data : {"base_url":"https://my-hidden-url/invitation","email":"myhiddenemail@email.fr"}

Notes:

  • I replaced the base_url and the email with fake data.
  • I did not append a trailing slash to the base_url as the documentation implies.
  • I use the free-tier self-hosted plan.
  • I provide only required params and thus the permissions param is not provided (the logs below seem to show a permissions error).

I may be misunderstanding the documentation : Baserow API spec. It says that “An email containing a sign up link will be send to the user.” which suits my needs. What I’m not sure of is if the user needs to have registered as Baserow account, or if said user can click on the invitation link and create its account automatically (or afterwards providing a password?).

Provide screenshots or include share links showing:

I did not provide screenshots of the database as it seems workspace-related only.

How many rows in total do you have in your Baserow tables?

A bit less than 1000 for now.

Please attach full logs from all of Baserow’s services

Sep 05 08:57:29 [2024-09-05 06:57:29 +0000] [37] [DEBUG] POST /api/workspaces/invitations/workspace/34/
Sep 05 08:57:29 ERROR 2024-09-05 06:57:29,137 django.request.log_response:241- Internal Server Error: /api/workspaces/invitations/workspace/34/ <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - Traceback (most recent call last): <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/django/core/handlers/exception.py", line 55, in inner <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - response = get_response(request) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/django/core/handlers/base.py", line 197, in _get_response <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - response = wrapped_callback(request, *callback_args, **callback_kwargs)
Sep 05 08:57:29 File "/app/code/env/lib/python3.10/site-packages/django/views/decorators/csrf.py", line 56, in wrapper_view <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - return view_func(*args, **kwargs) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/django/views/generic/base.py", line 104, in view <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - return self.dispatch(request, *args, **kwargs) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/rest_framework/views.py", line 509, in dispatch <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - response = self.handle_exception(exc) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/rest_framework/views.py", line 469, in handle_exception <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - self.raise_uncaught_exception(exc) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/rest_framework/views.py", line 480, in raise_uncaught_exception <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - raise exc <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/env/lib/python3.10/site-packages/rest_framework/views.py", line 506, in dispatch <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - response = handler(request, *args, **kwargs) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/usr/lib/python3.10/contextlib.py", line 79, in inner <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - return func(*args, **kwds) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/backend/src/baserow/api/decorators.py", line 230, in func_wrapper <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - return func(*args, **kwargs) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/backend/src/baserow/api/decorators.py", line 105, in func_wrapper <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - return func(*args, **kwargs) <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - File "/app/code/backend/src/baserow/api/workspaces/invitations/views.py", line 188, in post <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - data["permissions"], <30>1 2024-09-05T06:57:29Z debian-2gb-nbg1-1 bb20583a-b8c1-4972-a871-06d076a113cf 173657 bb20583a-b8c1-4972-a871-06d076a113cf - KeyError: 'permissions'
Sep 05 08:57:29 172.18.0.1 - - [05/Sep/2024:06:57:29 +0000] "POST /api/workspaces/invitations/workspace/34/ HTTP/1.1" 500 145 "https://fsu.l8l.link/" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"

Thanks for your help, my Baserow experience has been a pleasure so far :slight_smile:

2

When providing the non-required permissions param with “member” as value, the API call works. However, the base_url cannot be the frontend URL but the Baserow dashboard URL, sadly. Would there be a way to allow a custom view in Nextjs for workspace invitation acceptance?

3

Good morning @EquipeL8L, thank you for the bug report!

I can confirm that if no permissions are provided, then the API throws a 500. I’ve opened an issue to get this resolved for you. In the meantime, a permissions string will need to provided in the request.

Regarding this:

However, the base_url cannot be the frontend URL but the Baserow dashboard URL, sadly. Would there be a way to allow a custom view in Nextjs for workspace invitation acceptance?

I am unsure, perhaps another team member will be able to help with this bit.

Cheers,
Peter Evans

4

About my last reply, I managed to use Cloudron environment variables so that the base_url can be the frontend URL.

So the subject of this topic may actually be to update the Baserow docs to let developers know that “permissions” is a required param in the create_workspace_invitation API :slight_smile: