Missing default permissions?

[volfco]

When I call http://frontier:8080/v1beta1/users/self/projects?with_permissions=app.organization.billingview I'm getting an internal server error:

{
  "code": 13,
  "message": "internal server error",
  "details": []
}

the server logs show:

2025-12-27T04:42:58.817Z	error	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:42:58]	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:42:58]	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:42:58]	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:42:58]	administer: relation/permission `administer` not found under definition `app/project`	{"grpc.start_time": "2025-12-27T04:42:58Z", "system": "grpc", "span.kind": "server", "grpc.service": "raystack.frontier.v1beta1.FrontierService", "grpc.method": "ListProjectsByCurrentUser", "x-request-id": "53d46584f1f6c91b865e1c49207edd25", "peer.address": "127.0.0.1:35918"}
[2025-12-26  20:42:58]	2025-12-27T04:42:58.817Z	error	finished unary call with code Internal	{"grpc.start_time": "2025-12-27T04:42:58Z", "system": "grpc", "span.kind": "server", "grpc.service": "raystack.frontier.v1beta1.FrontierService", "grpc.method": "ListProjectsByCurrentUser", "error": "rpc error: code = Internal desc = internal server error", "grpc.code": "Internal", "x-request-id": "53d46584f1f6c91b865e1c49207edd25", "grpc.time_ms": 31.838}
[2025-12-26  20:43:49]	2025-12-27T04:43:49.508Z	error	app_organization_billingview: relation/permission `app_organization_billingview` not found under definition `app/project`
[2025-12-26  20:43:49]	app_organization_billingview: relation/permission `app_organization_billingview` not found under definition `app/project`
[2025-12-26  20:43:49]	app_organization_billingview: relation/permission `app_organization_billingview` not found under definition `app/project`
[2025-12-26  20:43:49]	app_organization_billingview: relation/permission `app_organization_billingview` not found under definition `app/project`
[2025-12-26  20:43:49]	app_organization_billingview: relation/permission `app_organization_billingview` not found under definition `app/project`	{"grpc.start_time": "2025-12-27T04:43:49Z", "system": "grpc", "span.kind": "server", "grpc.service": "raystack.frontier.v1beta1.FrontierService", "grpc.method": "ListProjectsByCurrentUser", "x-request-id": "03fd627f9212f9e71a9798b14d801755", "peer.address": "127.0.0.1:35918"}
[2025-12-26  20:43:49]	2025-12-27T04:43:49.508Z	error	finished unary call with code Internal	{"grpc.start_time": "2025-12-27T04:43:49Z", "system": "grpc", "span.kind": "server", "grpc.service": "raystack.frontier.v1beta1.FrontierService", "grpc.method": "ListProjectsByCurrentUser", "error": "rpc error: code = Internal desc = internal server error", "grpc.code": "Internal", "x-request-id": "03fd627f9212f9e71a9798b14d801755", "grpc.time_ms": 29.568}

I've tried running the database migration process and restarting both frontier and spicedb with no effect. I'm not sure if this is a bug, or something never got initialized correctly but I'm running into this while trying to integrate Frontier for my app

[volfco]

I'm using v0.80.1... which is outdated. Let me upgrade. Might fix this

[volfco]

Nope.

[2025-12-26  20:52:58]	WARNING: running in development mode, bypassing all authorization checks
[2025-12-26  20:52:58]	2025-12-27T04:52:58.993Z	info	frontier starting	{"version": "v0.86.1"}
[2025-12-26  20:52:59]	2025-12-27T04:52:59.034Z	info	Connected to spiceDB: spicedb:50051
[2025-12-26  20:52:59]	2025-12-27T04:52:59.037Z	info	mailer enabled	{"host": "smtp.mailgun.org", "port": 587}
[2025-12-26  20:52:59]	2025-12-27T04:52:59.037Z	warn	stripe key is empty, billing services will be non-functional[]
[2025-12-26  20:52:59]	2025-12-27T04:52:59.039Z	info	metaschemas loaded	{"count": 7}
[2025-12-26  20:52:59]	2025-12-27T04:52:59.175Z	info	migrated authz schema
[2025-12-26  20:52:59]	2025-12-27T04:52:59.189Z	info	ui server starting	{"http-port": 8082}
[2025-12-26  20:52:59]	2025-12-27T04:52:59.209Z	info	connect server starting	{"port": 8002}
[2025-12-26  20:52:59]	2025-12-27T04:52:59.211Z	info	api server starting	{"http-port": 8080, "connect-port": 8002, "grpc-port": 8081, "metrics-port": 9000}
[2025-12-26  20:54:41]	2025-12-27T04:54:41.896Z	error	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:54:41]	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:54:41]	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:54:41]	administer: relation/permission `administer` not found under definition `app/project`
[2025-12-26  20:54:41]	administer: relation/permission `administer` not found under definition `app/project`	{"grpc.start_time": "2025-12-27T04:54:41Z", "system": "grpc", "span.kind": "server", "grpc.service": "raystack.frontier.v1beta1.FrontierService", "grpc.method": "ListProjectsByCurrentUser", "x-request-id": "e015086cf2d82108f785085dbbf2749c", "peer.address": "127.0.0.1:44024"}
[2025-12-26  20:54:41]	2025-12-27T04:54:41.896Z	error	finished unary call with code Internal	{"grpc.start_time": "2025-12-27T04:54:41Z", "system": "grpc", "span.kind": "server", "grpc.service": "raystack.frontier.v1beta1.FrontierService", "grpc.method": "ListProjectsByCurrentUser", "error": "rpc error: code = Internal desc = internal server error", "grpc.code": "Internal", "x-request-id": "e015086cf2d82108f785085dbbf2749c", "grpc.time_ms": 33.002}

[ravisuhag]

Closing as this is most likely a bootstrap/migration issue rather than a code bug. Here's what's happening and how to fix it.

Root cause: The administer permission for app/project is not defined statically in the base SpiceDB schema (base_schema.zed). It's dynamically generated during Frontier's bootstrap migration (MigrateSchema() → ApplyServiceDefinitionOverAZSchema()), which registers permissions like app_project_administer in both SpiceDB and the permissions database.

When you call ListProjectsByCurrentUser with with_permissions, the handler looks up the permission name in the database. If bootstrap didn't complete successfully, the permission won't exist there, causing this error.

Most likely fix:

1. Ensure frontier server starts cleanly without errors — watch for any bootstrap/migration failures in the startup logs
2. If upgrading between versions, the bootstrap migration must run to completion to register any new permissions
3. Check that both your Postgres database and SpiceDB instance are accessible during startup — if either is unreachable, the migration silently fails and permissions won't be registered

If the issue persists after a clean restart, check the permissions table in Postgres to verify app_project_administer exists. If it doesn't, a fresh frontier server start with both databases accessible should populate it.

If this is still reproducible on the latest release, please reopen with your startup logs.