Cannot assign permissions to the user role as the admin user

Issues
1

Issue Description

I removed the some permissions from the user role.

When I try to re-add them using the same admin role that removed them I get the error “You are not authorized to grant permissions: <permission>”

Expected Behavior

Admin role should be able to add permissions to the user role

Actual Behavior

Error received

Reproduction Steps

  • Edit the user role
  • Remove a permission such as JMAP: Retrieve Sieve filter script details.
  • Save
  • Edit and try to add the removed permission

Stalwart Version

v0.16.x

Installation Method

Binary (Linux)

Database Backend

PostgreSQL

Blob Storage

PostgreSQL

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Based on how role permission checks work in Stalwart, this is almost certainly a stale permission cache issue rather than a bug in the admin role itself.

The admin role is defined to grant “every permission defined by the server,” so an administrator should always be able to grant any permission to another role. The x:Role/set (and similar) handler enforces this by comparing the permissions you’re trying to grant against the permissions baked into your current session’s access token — and resolved access tokens are cached (see the accessTokens cache) to avoid re-validating permissions on every request. If you removed and then tried to re-add a permission in the same session, your cached access token may not yet reflect the up-to-date permission set, which triggers the “You are not authorized to grant permissions” error.

Try one of the following and re-attempt the edit:

  1. Log out and log back in as the admin account (forces a fresh access token), or
  2. Invalidate caches from the WebUI (Settings › there is an “Invalidate all caches” action), which clears the cached access tokens immediately.

If the error persists after a fresh login/cache invalidation, that would indicate an actual bug worth a full bug report with exact permission names and role setup.

https://support.stalw.art — relevant docs: Roles and Cache

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

An account can only grant permissions it holds itself, and the default admin gets its JMAP, IMAP and Sieve permissions through the User role it also carries. Removing “Retrieve Sieve filter script details” from User removed it from the admin as well, so the admin has nothing left to grant it back with.

To undo it, start Stalwart with STALWART_RECOVERY_ADMIN=<user>:<password> set, sign in as that account (it holds every permission), add the permission back to the User role, then remove the variable and restart: Recovery mode | Stalwart. If you plan to trim the User role again, first give your admin a custom role that holds those permissions directly, so editing User can’t lock it out. The roles page currently claims the admin role grants every permission, which is wrong; I’ll correct it.