Discussion regarding default population of REST

ovlb · December 21, 2021, 10:59am

I’ve opened a GitHub issue, where you can add your voice/context.

Relations are not populated if API key is read-only

opened 12:05PM - 15 Dec 21 UTC

## Bug report ### Describe the bug In v4.0.0 relations inside API response…s do not show up if the API key is set to «read-only». For this it does not matter how the `populate` query param is formatted (e.g. `populate=*` or `populate[0]=authors&populate[1]=categories`). This [solution for deeply nested relations](https://github.com/strapi/strapi/issues/11836#issuecomment-989131330) does not work either. The only solution so far is to set the type of the API key to «Full Access». While this might be fine in some circumstances, it is not in other. (E.g. I’m currently building an 11ty site with Strapi as a CMS and the 11ty build should only have read access. ### Steps to reproduce the behavior 1. Go to Settings -> 2. Create a new API key with read-only permissions 3. Create a new model w/ some relations (the restaurant example from the docs or [this one](https://github.com/strapi/strapi/issues/11787#issuecomment-986232765)). 4. Request the page in Paw or another API client, using the API token, and the `populate=*` query param 5. Relations are not showing up ### Expected behavior Relations should be populated ### Screenshots Figure 1: API response with a read-only API key <img width="1352" alt="" src="https://user-images.githubusercontent.com/7645967/146183045-89ef16e3-0f21-4e7b-9efe-13b6f781257a.png"> Figure 2: API response with a full access API key (expected behaviour) <img width="1348" alt="" src="https://user-images.githubusercontent.com/7645967/146183202-a8d72a6f-843d-4c45-b886-160555d05a57.png"> ### System - Node.js version: v14.5.0/v16.13.1 - NPM version: v6.14.5/v.8.1.2 - Strapi version: v4.0.0 - Database: Postgres - Operating system: macOS/Ubuntu