On any access-controlled collection (assets, content, users, …), a non-super user's PATCH or DELETE always fails with UNAUTHORISED — even for a resource they can see in the list and own, or that is public.
The per-item access check in AbstractApiModule.requestHandler is invoked with the Mongo query rather than the target document, so accessCheckHook grants — which read document fields like _access and createdBy — can never match. Super users are unaffected because they bypass the check.
Introduced by the _access unification (#108, api 4.0.0).
On any access-controlled collection (assets, content, users, …), a non-super user's PATCH or DELETE always fails with
UNAUTHORISED— even for a resource they can see in the list and own, or that is public.The per-item access check in
AbstractApiModule.requestHandleris invoked with the Mongo query rather than the target document, soaccessCheckHookgrants — which read document fields like_accessandcreatedBy— can never match. Super users are unaffected because they bypass the check.Introduced by the
_accessunification (#108, api 4.0.0).