Issue with SSO and media plugin causing errors and broken editing in Sanity installation.

I have a sanity installation setup with SSO which has worked great for the last 6 months. Today i installed the media plugin (https://www.sanity.io/plugins/sanity-plugin-media ) and now things really don’t work anymore. Right after login i am greeted with an error prompt saying: “Error: Unauthorized - User must be a member of this project to perform this operation”. From the console output and network log, it looks like this error is due to a HTTP 401 response after a call to https://PROJECT_ID.api.sanity.io/v2021-06-07/projects/PROJECT_ID/datasets/DATASET_NAME/acl?tag=sanity.studio.acl.get I am running the latest version of sanity (ran sanity upgrade). Editing is completely broken and giving me an error message of: “undefined is not an object (evaluating ‘currentUser.roles.length’)“. Any suggestions on where to go from here?

Hey – this seems like more of an ACL / auth issue rather than something tied specifically to the plugin
That said (and just spitballing here):
- Does the issue still persist when you uninstall

sanity-plugin-media

? - Are you seeing the issue locally or on a deployed studio? 
- If you are seeing this locally, have you tried running

sanity logout

and then

sanity login

? (It could be the case you’re logged into another project’s Studio)

Yes, i agree, but just wanted to mention it in case it was related somehow. Seeing this locally, so i will try it in an test environment.

sanity login

doesn’t really work with SSO, since there is no “SSO” option.

So, i did a little more digging. Initial finding is that the “desk tool” still crashes when i go to open/edit a document. The error output is from

PermissionCheckBanner

and it now says: “Cannot read property ‘length’ of undefined”. This is the line which fails :
Adding a console log i see that currentUser does not have a

roles

property, but instead a

role

property with the value of

editor

as a string.

And the

role

property with a value of

editor

i assume is linked to this guide: https://www.sanity.io/docs/third-party-login#generating-sanity-tokens-ca87073af0ca So somewhere, an array must be added perhaps instead of a string? :)

This is on v 2.11.1 of the desk-tool by the way

Ahhh, this makes sense. Thanks for digging into it, will see if we can add a fix for this asap

I think this should be fixed now, could you give it a try?

Well, things have changed so it seems editing works, but i now get a 500 internal server error when Sanity Studio loads the previous mentioned

/acl

url

🕵️‍♂️ I'm seeing a bug where system groups has an unexpected shape - one that doesn't have a

members

array. Pushing out a fix shortly

Fix should be out now 👍

Fix should be out now 👍

Yes, looking and working great now. Thanks 🙂

Awesome, thanks so much for reporting 🙏

Awesome, thanks so much for reporting 🙏