Data-based RBAC on Admin panel

System Information
  • Strapi Version: 5.4.1
  • Operating System: MacOS
  • Database: sqlite
  • Node Version: v20.14.0
  • NPM Version: 10.7.0
  • Yarn Version:

(originally posted on wrong forum)
Hello, this is my very first topic here.

I’m working on a PoC using new Strapi v5. My requirements are similar to a news site with multiple sections. So I have a “sections” collection, with items like “Sports”, “Politics”, “Health”, etc. “section” has a relation with users from admin panel. And users can have permission on one or more sections.

After reading some docs, I tried something like this to use on “News” collection associated with “Editor” role but it’s not working:

async bootstrap({ strapi }: { strapi: Core.Strapi }) {

    await strapi.admin.services.permission.conditionProvider.register( {
      displayName: 'User has permission on section',
      name: 'user-permission-section',
      async handler(user: any) {
        return { 
          "section.admin_users": { 
              $elemMatch: {
                username: user.username
              }
          }
        };
      },
    });
  },

With this code, I can see all rows, one of them(the one with no admin_users) without any info in the table. I expect to see only one row, with the object “News” related to “Section” with my user as one of the “admin_users”.

Looks wrong to me, but I couldn’t find much docs. Is there any way to debug this behaviour?