Granular permissions are not working as expected.

We encountered this issue as well trying to limit the ability of lower level roles to see lower level environments other than prod, while still allowing them to see the color indicator for prod.

I'm working on a refactor that does away with the config overrides in settings.php, as the information is already in the config entities. Along with that is a refactoring of the permissions. There was a bug when the active environment could be blank. I took a long look at the permissions and they will be configured as follows:

- If a user "has access environment indicator" they can see everything.
- If a user does not have that permission, you mush opt the role into each environment via each respective permission.

When a user visits an environment in their browser, they must have permission to access the indicator for that particular environment, otherwise nothing will show.

@timwood I don't really understand your use case.

@devkinetic Thanks for working on this!

Our use case is for non-admin users to see the admin toolbar with environment indicator color but NOT the switcher.

Gotcha. The javascript (which is where the colors and favicon come from) is only included if you have access to the environment. That is a different issue than the issue description.

I'm pretty sure the issue here is the bug I found. It all centers around determining the currently active environment. There is no connection between the config overrides and the EnvironmentIndicator entities.

Just wanted to add our use case to @timwood's.

Our switcher is currently configured for 4 environments: Dev, Test, Prod and a link to the public site (which is served from a different host than our production host).

We want non-admin contributors to see the color and the switcher for only Prod and the public site.

Thanks!

I think a core feature was overlooked in the conversion. The initial permission, "access environment indicator" should solely drive the toolbar in the basic version, or the tab when using the toolbar. Having access to environments should only be taken into account building the selector or determining more advanced per-environment settings.