Hi,
I’m facing a strange issue in Grist. When an editor tries to reference an attachment that was uploaded via API or by an admin, they get the following error:
“Cannot access attachment”
However:
The table itself has no special permissions or restrictions;
Editors can upload a file themselves and reference its Attachment ID (e.g. [20]) — and it works perfectly;
But if the file was uploaded through the API or by an admin, and an editor tries to reference its ID (e.g. [21]), the above error occurs.
Questions:
Is this expected behavior?
Is there a separate permission system for attachments, distinct from the table’s permissions?
How can I ensure that editors have access to all attachments, regardless of who uploaded them?
I can confirm that this makes handling attachment uploads in custom widgets particularly challenging, because Editors cannot reference attachments they could upload through the widget API…
I don’t know if it will help, but I remember reading somewhere that accessing attachments via custom widgets, HTML viewer widget, or anything else calling attachment by their API link, required the document to be set to public access for it to work.
In my case, I was trying to make a welcome page to my document, with 1-2 images included as attachments in it, when I saw this message. Worse : I didn’t see it immediately, just their alt-text instead, whereas it was working perfectly fine in another document. Same HTML, same attachment. The only difference was this public read-only access on the first one.
As my document had its own advanced permission rules setted, In that case, I was able to safely enable public access. Once activated, the images I attached magically started loading.
The main problem here is the way Grist make available attachments : no internal link, so each call use the API as if an external visitor would request these assets.
