User suddenly getting PermissionDenied in Resolvable-Alias of cache

[ben-ganley]

Describe the bug
A user suddenly started to get the following error in Boundary

Output from the cache status

    Resolvable-Alias:
      Count:                    0
      Last Error Message:
      cache.(Repository).refreshResolvableAliases: for token "at_D9zDTjoOBy":
      cache.defaultResolvableAliasFunc: unknown, unknown: error #0:
      {"kind":"PermissionDenied", "message":"Forbidden."}

The users config is identical to all other uses (managed via IAC) and no other users are experiencing this issue. We have tried to remove clean and reinstall the boundary desktop client.

We have removed the user from Boundary and then reprovisioned them but still experience the issue with just this one user.

To Reproduce
Steps to reproduce the behavior:

1. Open boundary desktop
2. Open targets, expect to see targets
3. See no targets, check settings panel, see cache warning

Expected behavior
The user should be able to access the targets as configured.

Additional context
Boundary CLI version 0.19.1
Boundary Desktop Verion 2.3.1

cache.log

[johanbrandhorst]

Hi, thanks for your issue. This implies that the user may be missing the list-resolvable-aliases grant. Could you check if this grant has been granted to the user, or if adding the grant resolves the issue? Note that grants are per-scope, so you may need to add this to every project or to a parent org and make it inherited by child scopes. Could you produce a list of the grants granted to the user through all their roles and groups to help debug the issue?