Foo Developer created FINERACT-2983:
---------------------------------------
Summary: Roles and Permissions - CREATE_GROUP, UPDATE_GROUP and
DELETE_GROUP cannot be removed from a role (update returns success but the
permissions stay granted)
Key: FINERACT-2983
URL: https://issues.apache.org/jira/browse/FINERACT-2983
Project: Apache Fineract
Issue Type: Bug
Components: Groups
Reporter: Foo Developer
Assignee: Foo Developer
Description
On a role, the permissions CREATE_GROUP, UPDATE_GROUP and DELETE_GROUP
(Permissions > Group) cannot be unchecked. The save succeeds and the toast
"Permissions updated successfully" is shown, but after reloading, the three
permissions are checked again. The same happens when calling the API directly:
PUT /roles/{roleId}/permissions answers 200 and even lists the change, but GET
/roles/{roleId}/permissions still returns selected = true. All other
permissions (including DELETE_GROUP_CHECKER and every other group permission)
are removed normally in the same save.
Users with that role keep the Create / Edit / Delete group actions, so a role
cannot be restricted from editing or deleting groups.
Preconditions
Logged in as Admin. Role "client" (id 155) has CREATE GROUP, UPDATE GROUP and
DELETE GROUP checked.
Steps to reproduce
Go to Admin > System > Roles and Permissions > client.
Click Edit Permissions and select the "Group" permission group.
Uncheck CREATE GROUP, UPDATE GROUP and DELETE GROUP (optionally also another
group permission such as CLOSE GROUP).
Click Submit. "Permissions updated successfully" is shown.
Reload the page and open the "Group" permission group again.
Optional API check: PUT /fineract-provider/api/v1/roles/155/permissions with
body
{"permissions":{"CREATE_GROUP":false,"DELETE_GROUP":false,"UPDATE_GROUP":false}},
then GET /fineract-provider/api/v1/roles/155/permissions.
Log in as a user with only this role and open any group (e.g. Groups > Nour
Restricted GRoup, 631), then open the action menu and hover More.
Actual result
After reload, CREATE GROUP, UPDATE GROUP and DELETE GROUP are checked again.
CLOSE GROUP and the other unchecked permissions stay unchecked.
The PUT answers 200 with
{"resourceId":155,"changes":{"permissions":{"CREATE_GROUP":false}}}, but the
following GET returns CREATE_GROUP, DELETE_GROUP and UPDATE_GROUP with
"selected": true.
The restricted user still sees Edit in the group menu and Delete under More.
Expected result
Unchecking CREATE_GROUP, UPDATE_GROUP and DELETE_GROUP is saved like any other
permission, the GET returns selected = false, and users with that role no
longer see the matching group actions. If these permissions are intentionally
locked, the API should return a validation error instead of a success response.
Impact
Admins cannot remove group create/edit/delete rights from a role, and the
success message hides that the change was not saved. A user can delete a group
even though the admin removed that permission.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
