[6.x] Don't save group-inherited roles as explicit roles - #15188
Open
duncanmcclean wants to merge 1 commit into
Open
[6.x] Don't save group-inherited roles as explicit roles#15188duncanmcclean wants to merge 1 commit into
duncanmcclean wants to merge 1 commit into
Conversation
`Statamic\Auth\Eloquent\User` used `roles()` in `data()` and `saveRoles()`, which merges explicitly assigned roles with roles inherited from user groups. Group roles were rendered as checked in the Roles field and persisted into `role_user`, so they were left behind when the user was removed from the group. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request fixes an issue where roles inherited from a user group were saved against the user as though they'd been assigned directly, when using database-driven users. Removing the user from the group afterwards would leave those roles behind, orphaned in the
role_usertable.This was happening because
Statamic\Auth\Eloquent\Userwas usingroles()in bothdata()andsaveRoles(). That method merges the user's explicitly assigned roles with the roles they inherit from their groups, so the group's roles were rendered as checked in the Roles field, and were then written intorole_useron save. The file driver isn't affected, since it only ever stores explicitly assigned handles.This PR fixes it by using
explicitRoles()in both places.roles()still merges group roles, so permissions are unaffected.It's worth noting this doesn't clean up rows written by the previous behaviour — users already affected will keep their duplicated
role_userrows until they're saved again with the Roles field corrected.Fixes #15183