GraphQL error - Exceptions::Forbidden Ticket Create - First customer user login via mobile view

Infos:

  • Zammad version: 6.4.0
  • Used Zammad installation type: package
  • Operating system: debian 11
  • Browser + version: Firefox 132.01, Chrome Mobile aktuell

Issue Summary:

Users with the ticket.customer role can create tickets in the standard group/pool when using the desktop version of the platform. However, when they log in for the first time via the mobile view, they encounter an issue: although they receive a green success message saying the ticket has been created, the ticket is not actually created. In the browser console, the following error is logged:

“GraphQL error - Exceptions::Forbidden]: Access forbidden by Gql::Types::GroupType, Path: ticketCreate undefined”

Expected behavior:

When a customer logs in via the mobile view for the first time, they should be able to create tickets in the standard group/pool, just like they can in the desktop view.

Actual behavior:

  • When a new customer user logs in via mobile view for the first time and submits a ticket, a green message appears saying the ticket was created, but no ticket is actually created.
  • The error message in the console (“Access forbidden by Gql::Types::GroupType”) indicates a permissions issue with the ticketCreate request.
  • If the customer switches to the desktop version and submits the ticket, everything works fine, and the ticket is created in the Standard Group/Pool.
  • After this, the customer can return to mobile view and successfully create tickets, with no further errors.

First Login via mobile view
Create Ticket:





Nothing to see, in the list of new created tickets

Console Error Firefox

Login via Desktop View

The ticket was generated successfully

Login via Mobile View again

Create new Ticket “Testticket2”



Ticket was successfully created now in Mobile View with no console error.

Interesting, I think the error message, in general, is in a “normal” situation no problem, because it can definitely happen that the creator has no permission on the created ticket. But in the customer context, this should normally not happen and should always work like in the second try.

We will investigate, if we find something.