Search code examples
javascriptpythongetstream-io

NotAllowedException when reading feeds on the client

Hi I'm new to GetStream and still learning. Here is a condensed version of what I'm using.

I have a python backend where I create user tokens:

client = stream.connect(...)
token = client.create_user_token(id)
return token

I then pass the token to the js frontend where it's used to retrieve feed activities for that user. I'm using the normal stream-js client and Jinja for the token and collection.id:

const client = stream.connect('apiKey', null, 'appID');
const collection = client.feed('collection', '{{ collection.id }}', '{{ token }}')
request = collection.get({ limit:10})
request.then((data) => {
   ...
)}

Here is my problem: When I request activities for collection:4 everything works as would be expected. But when I do the exact same thing for collection:5 it suddenly gives "You do not have permission to do this, you got this error because there are no policies allowing this request on this application." 403 NotAllowedException. This only happens client-side, server-side it works fine. Could there be a problem in the jwt token used for authentication? Thanks for any help.

Solution

  • By default, users can read their own feeds on the client side.

    collection:4 is working because probably token is generated for the user with id 4 and it fails with permission error when that token is used for collection:5.

    To have required policies in your app, please contact support with your app details and required policies/feed groups.