* Describe the bug
* Environment
- NocoBase version: v2.0.1
- Database type and version: PostgreSQL 17
- OS: Linux
- Deployment Methods: Docker
- Docker image version: nocobase/nocobase:latest
* How To Reproduce
https://a_8hwne7u84ho.v13.demo.nocobase.com/admin/gxpzwd86ai1/view/b7ab82f233d/filterbytk/1
select a role that can edit the m2m field but cannot configure the interface and try to disassociate an item from a m2m relationship. For some reason if the role can configure the interface, they can disassociate. associating works fine for both case.
at first, it seems like it succeeded since there were no error response. however, after refresh the item to be disassociated is still there.
Expected behaviour
it should’ve disassociate properly regardless of the role.
Screenshots
none
Logs
{“level”:“error”,“message”:“No permissions”,“extra”:{“method”:“error-handler”,“err”:“ForbiddenError: No permissions\n at Object.throw (/app/nocobase/node_modules/koa/lib/context.js:97:11)\n at middlewares.add.tag (/app/nocobase/node_modules/@nocobase/acl/lib/acl.js:419:20)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at checkAssociationOperate (/app/nocobase/node_modules/@nocobase/plugin-acl/dist/server/middlewares/check-association-operate.js:37:12)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/plugin-acl/dist/server/server.js:506:14\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/acl/lib/allow-manager.js:118:13\n at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n at async ACLMiddleware (/app/nocobase/node_modules/@nocobase/acl/lib/acl.js:336:14)\n at async app.resourcer.use.group (/app/nocobase/node_modules/@nocobase/plugin-api-keys/dist/server/plugin.js:62:9)\n at async /app/nocobase/node_modules/@nocobase/plugin-users/dist/server/server.js:208:7\n at async deleteRolesCache (/app/nocobase/node_modules/@nocobase/plugin-users/dist/server/server.js:197:7)\n at async handleFieldSourceMiddleware (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:463:7)\n at async mergeReverseFieldWhenSaveCollectionField (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:413:7)\n at async templateDataMiddleware (/app/nocobase/node_modules/@nocobase/plugin-block-template/dist/server/middlewares/templateData.js:45:3)\n at async pushUISchemaWhenUpdateCollectionField (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:374:7)\n at async pushUISchemaWhenUpdateCollectionField (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:355:7)\n at async appendDataToRolesCheck (/app/nocobase/node_modules/@nocobase/plugin-data-source-manager/dist/server/plugin.js:567:7)\n at async loadDataSourceTablesIntoCollections (/app/nocobase/node_modules/@nocobase/plugin-data-source-manager/dist/server/middlewares/load-tables.js:88:3)\n at async setDataSourceListDefaultSort (/app/nocobase/node_modules/@nocobase/plugin-data-source-manager/dist/server/plugin.js:313:7)\n at async showAnonymous (/app/nocobase/node_modules/@nocobase/plugin-acl/dist/server/server.js:482:7)”},“meta”:{“err”:“ForbiddenError: No permissions\n at Object.throw (/app/nocobase/node_modules/koa/lib/context.js:97:11)\n at middlewares.add.tag (/app/nocobase/node_modules/@nocobase/acl/lib/acl.js:419:20)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at checkAssociationOperate (/app/nocobase/node_modules/@nocobase/plugin-acl/dist/server/middlewares/check-association-operate.js:37:12)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/plugin-acl/dist/server/server.js:506:14\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/acl/lib/allow-manager.js:118:13\n at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n at async ACLMiddleware (/app/nocobase/node_modules/@nocobase/acl/lib/acl.js:336:14)\n at async app.resourcer.use.group (/app/nocobase/node_modules/@nocobase/plugin-api-keys/dist/server/plugin.js:62:9)\n at async /app/nocobase/node_modules/@nocobase/plugin-users/dist/server/server.js:208:7\n at async deleteRolesCache (/app/nocobase/node_modules/@nocobase/plugin-users/dist/server/server.js:197:7)\n at async handleFieldSourceMiddleware (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:463:7)\n at async mergeReverseFieldWhenSaveCollectionField (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:413:7)\n at async templateDataMiddleware (/app/nocobase/node_modules/@nocobase/plugin-block-template/dist/server/middlewares/templateData.js:45:3)\n at async pushUISchemaWhenUpdateCollectionField (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:374:7)\n at async pushUISchemaWhenUpdateCollectionField (/app/nocobase/node_modules/@nocobase/plugin-data-source-main/dist/server/server.js:355:7)\n at async appendDataToRolesCheck (/app/nocobase/node_modules/@nocobase/plugin-data-source-manager/dist/server/plugin.js:567:7)\n at async loadDataSourceTablesIntoCollections (/app/nocobase/node_modules/@nocobase/plugin-data-source-manager/dist/server/middlewares/load-tables.js:88:3)\n at async setDataSourceListDefaultSort (/app/nocobase/node_modules/@nocobase/plugin-data-source-manager/dist/server/plugin.js:313:7)\n at async showAnonymous (/app/nocobase/node_modules/@nocobase/plugin-acl/dist/server/server.js:482:7)”},“module”:“student”,“submodule”:“update”,“method”:“error-handler”,“app”:“main”,“reqId”:“1d36339a-058f-4b86-9365-50130422305e”,“dataSourceKey”:“main”,“timestamp”:“2026-03-26 16:27:52”}