Providence 2.0.9 cant download images and access control issues

theCA

In providence 2.0.9 (also happens in 2.0.8) an object was created and an object representation was asigned.
When in the object editor (also from summary), when you click in the image and then try to download the image using the download icon you get "access denied" (and also displayed in the app log)
The traces leaves me to /var/www/html/ca/app/lib/BaseEditorController.php line 2529
i went first to the isReadable function but in some point i realized that the code was never reaching that point.
so, i went back to BaseEditorController to try to understand the exec flow and put a line on top of the offending one:

print_r ($t_rep->isReadable($this->request->user));
return;

and i see nothing, like empty and i was expecting 1 or 0 from the possible outputs of the isReadable function.

And if I print the content of $t_rep itself i get:
ca_object_representations Object ( [errors] => Array ( ) [error_output:BaseObject:private] => [ACCESS_MODE:BaseModel:private] => [o_db:BaseModel:private] => Db Object ( [opb_die_on_error] => [errors] => Array ( ) [opo_db:Db:private] => Db_mysqli Object ( [opr_db] => mysqli Object ( [affected_rows] => 11 [client_info] => mysqlnd 8.3.6 [client_version] => .....

I also tried to change $t_rep->isReadable($this->request->user) with $t_rep->isReadable($this->request) since it looked to me that the isReadable function was expecting a request not an user but no luck.

How can i troubleshoot this? We have all the level access enabled

seth

We have all the level access enabled

What do you mean by this? What is enabled exactly?

Do you have perform_item_level_access_checking, perform_source_access_checking or perform_type_access_checking set in your app.conf file?

theCA

i mean the three of them.

default_bundle_access_level = __CA_BUNDLE_ACCESS_EDIT__

perform_type_access_checking = 1
default_type_access_level = __CA_BUNDLE_ACCESS_EDIT__

perform_source_access_checking = 1
default_source_access_level = __CA_BUNDLE_ACCESS_NONE__

perform_item_level_access_checking = 1
default_item_access_level = __CA_ACL_EDIT_DELETE_ACCESS__

ca_collections_acl_inherit_from_parent_default = 1
ca_objects_acl_inherit_from_ca_collections_default = 1
ca_objects_acl_inherit_from_parent_default = 1

But even if I disable all three im still having issues.
Even weird, if after disabling and delete caches, I go to manage > access control > select a role, still see all the tabs like if all three ..._access_checking were still enabled.
But not sure if the two things are related.

seth

If they are all still showing then they're all still enabled somewhere in your configuration.

Also, enabling all three at the same time will make it that much more complicated to figure out why a given record is not accessible. Usually it's one or the other, not all .