Wix Studio Custom Dashboard Errors: Decoding WDE0027 and Permissions Glitches

The Wix Studio community forum recently highlighted a critical issue affecting custom dashboards, specifically concerning permissions and data operations. Users reported encountering "unexpected error" during file uploads to CMS collections and the explicit error "WDE0027: The current user does not have permissions to update on the All_Tickers collection." This analysis delves into the root causes and provides actionable solutions for store owners and developers leveraging Wix Studio's powerful custom dashboard capabilities.

Understanding the Core Problem: Permissions at Play

The user's report on the forum topic describes a scenario where custom dashboards, previously functioning without issues, suddenly began to fail. Two distinct but likely related problems emerged:

• "Unexpected Error" on File Uploads: When attempting to upload an image file and save it to a CMS collection, the dashboard returned a generic "unexpected error." This persisted even after attempting to update the code to use newer APIs.
• "WDE0027: The current user does not have permissions...": This error explicitly indicates a lack of permission for the current user to update a specific CMS collection, in this case, the "All_Tickers collection."

A crucial observation was that restoring a backup from several months prior yielded the same errors, suggesting that the issue wasn't directly tied to recent code changes but rather a change in the environment or how permissions are enforced. Furthermore, the user noted that setting the CMS collection permissions to "everyone" resolved the WDE0027 error, while more restricted settings (e.g., "Site Members") caused it to reappear. This strongly points towards a fundamental shift or misconfiguration in collection permissions.

The Root Cause: Evolving Permissions Enforcement

The most probable explanation for these errors, especially the explicit WDE0027 message, is a change in how Wix Studio enforces collection permissions. While the code itself might not have changed, the underlying platform's security model or default settings could have been updated, leading to stricter permission checks. When a custom dashboard interacts with a CMS collection to read, write, or upload files, it does so under the context of the currently logged-in user or the permissions granted to the specific backend function being called.

If permissions are configured for "Site Members" or a specific role, but the user accessing the dashboard does not meet these criteria, or if the system is misinterpreting the user's role, these errors will occur. The "unexpected error" for file uploads, when linked to saving to a CMS, is also highly likely a permission issue, as file storage and linking to a database often fall under the same security umbrella.

Solution: Reconfiguring CMS Collection Permissions

To resolve the WDE0027 error and likely the "unexpected error" related to CMS operations, a thorough review and adjustment of your CMS collection permissions are necessary. Follow these steps:

1. Identify Affected Collections: Pinpoint all CMS collections that your custom dashboard attempts to read from, write to, or link files with. In the forum example, this includes the "All_Tickers collection" and the collection where uploaded images are saved.
2. Navigate to Collection Permissions:
   1. From your Wix Studio dashboard, go to Content Manager.
   2. Select the specific collection that is causing issues (e.g., "All_Tickers").
   3. Click on the More Actions (three dots) menu next to the collection name.
   4. Choose Permissions.
3. Review and Adjust Permissions:

   Within the Permissions settings, you will see various actions (e.g., Read, Create, Update, Delete) and who is allowed to perform them. For each action your custom dashboard needs to perform, ensure the correct roles are assigned:

   • For "WDE0027: The current user does not have permissions to update...": Focus on the Update permission.
   • For "Unexpected Error" during file uploads: Ensure Create and Update permissions are correctly set for the collection where file references are stored.

   Based on the forum discussion, if "everyone" works but "Site Members" does not, it suggests that either:

   • The user accessing the dashboard is not correctly identified as a "Site Member."
   • The "Site Members" role itself has had its privileges altered or is not being correctly applied in the context of the custom dashboard.

   Recommended Action:

   • Initially, for troubleshooting, you might temporarily set the relevant permissions (e.g., Update, Create) to "Site Members" or "Admin" (if only admins should use the dashboard) and test.
   • If "Site Members" still fails, verify that the users are indeed logged in as site members when accessing the dashboard.
   • Consider creating a custom role with specific permissions if "Site Members" is too broad or too restrictive. Assign this custom role to the users who need access.
   • For operations requiring elevated permissions, especially in backend code, ensure you are using

     wix-members-backend

     functions or

     wix-users-backend

     functions with appropriate user authentication and authorization logic.
4. Save Changes and Test: After adjusting permissions, save your changes and thoroughly test your custom dashboard functionality to ensure all errors are resolved.

Best Practices for Custom Dashboard Security and Stability

To prevent similar issues in the future and maintain a robust custom dashboard, consider these best practices:

• Principle of Least Privilege: Always grant only the minimum necessary permissions for any user or role. Avoid setting permissions to "everyone" unless absolutely required for public-facing content.
• Role-Based Access Control (RBAC): Utilize Wix Studio's member roles to define granular access. Create custom roles as needed to precisely control who can do what within your custom dashboards and CMS.
• Backend Functions for Sensitive Operations: For any operations that modify CMS data or involve sensitive logic, implement them in backend web modules (.jsw files). These functions can control the context of execution and ensure proper authorization before performing actions. Use

  wix-members-backend

  to check user roles or permissions.
• Thorough Testing: After any platform updates or permission changes, always test your custom dashboards with different user roles (logged-in member, site admin, guest) to ensure functionality and security are intact.
• Monitor Wix Studio Updates: Stay informed about Wix Studio release notes and community discussions. Changes to platform APIs, security models, or permission enforcement are often announced, allowing you to proactively adapt your solutions.

By diligently managing your CMS collection permissions and adhering to security best practices, you can ensure your Wix Studio custom dashboards remain functional, secure, and free from unexpected errors like WDE0027.