[Bug]: Wall of denied permissions in User profile for some users

[swift2512]

Snipe-IT Version

Version v8.4.1 - build 22183 (master)

PHP Version

v8.3.3

Composer Version

2.8.6

MySQL/MariaDB version

mariadb Ver 15.1

How did you install Snipe-IT?

Git install

Is this a fresh install or an upgrade?

Upgrade

What happened?

Everything is OK with newly imported users. It's like on demo, only granted permissions are displayed. But on profiles of some older users I see a wall of red denied permissions. For example, two different users, from two different permission groups. Both are manually given admin rights (= full control), but permission tables are only partially true.

What browsers are you seeing the problem on?

No response

Can you reproduce this on the public demo?

N/A

Do you have full multiple company support enabled?

Yes

If you have full multiple company support enabled, do you have location scoping to company enabled?

No

Application log output

Browser console output

Common Issues

• I have searched this repo for existing issues related to my issue (including closed issues)
• My APP_URL is set correctly in my .env file (including http or https and no trailing slash)
• I have searched the official Snipe-IT documentation and have checked the Common Issues documentation (where applicable)
• I have run database migrations (where applicable).
• I have attached screenshots and/or videos of the issue (where applicable)

Code of Conduct

• I agree to follow this project's Code of Conduct

[swift2512]

I figured it out. It's the way individual and group permissions are displayed on user’s profile.
Permission status is displayed on user profile only then:

1. Individual permission is set to Granted (1) or Denied (-1) and not left at 0.
2. Permission group has permission(s) set to Granted (1) or Denied (-1)

When it's an individual permission for a single user, you can go back to Inherit (0) and red badge goes away.
In case of 'Permission groups', as soon as you toggle any permission and save it - there's no way back to 0 and permission status will always be displayed on user's profile as green or red badge. This results in a 'red wall' if this is an old account group that has every permission set to denied (ex., 'disabled user').

Maybe, user info page could display only granted permissions? I've just assigned two different user groups to same user: one grants superadmin and another - denies superadmin. User got superadmin rights... Looks like DENY doesn't block GRANTED and does anything, so this info could be omitted from user's view. To go even further:

• If user has superuser or admin permission - only this permission is shown on info-page and every individual permission is hidden
• Everything lower than superuser or admin shows only permissions that are GRANTED to this user.

This would provide cleaner look.

[snipe]

Everything lower than superuser or admin shows only permissions that are GRANTED to this user.

I don't think we'd want to hide denials, since groups can inherit and therefore neither grant nor deny.