"Adding non-existent permissions to a role is not allowed." exception is thrown for profile installations

Created on 20 July 2023, over 1 year ago
Updated 21 June 2024, 5 months ago

Problem/Motivation

This issue is closed (works as designed). See the "Proposed resolution" section below.

Original summary:

Attempting to install a profile which contains a user role which also has references to dynamic permissions that are only available at the end of installation currently triggers the following:

In Role.php line 207:

  [RuntimeException]

  Adding non-existent permissions to a role is not allowed. The incorrect permissions are "use search_api_autocomplete for search".

On further investigation, this occurs because the User Role configuration only stores the module entries as dependencies, rather than the actual entity configs which are necessary as part of the dynamic callback.

Meaning the sorted config when \Drupal\Core\Config\ConfigInstaller::createConfiguration() is called doesn't attempt to add the dependant search_api_autocomplete.search.search config first before it attempts to import the user role config.

Steps to reproduce

Attempt a custom profile installation which:

  1. Includes the search_api_autocomplete module as a dependency
  2. Has a custom search_api_autocomplete Autocomplete search config entity with an ID of "search" (search_api_autocomplete.search.search.yml)
  3. Installs a user role which includes the dynamically declared use search_api_autocomplete for search permission

And then attempt an installation of said profile which lead to the site installation failing.

Proposed resolution

The module that defines the permission is responsible for defining the dependencies. See the change record Permissions can define dependencies β†’ .

From the original issue summary:

We have a range of options:

  1. Ignore the user role validation during site installation until after the site is completely installed. Since at that point, all the relevant site dependencies should be installed before we can properly validate.
  2. Ensure that module config dependencies are also taken into account during the ConfigDependencyManager::sortAll() call (even if they're aren't explicitly stated to be so in the Role config)
  3. Ensure that user.role.* configs are always loaded last after being sorted by ConfigDependencyManager::sortAll()
  4. Update the Role config so that it also includes the config entities which are used as part of the permission_callbacks call (likely requires a massive API change for little or no gain)

Remaining tasks

User interface changes

N/A

Release notes snippet

TBD.

πŸ› Bug report
Status

Closed: works as designed

Version

11.0 πŸ”₯

Component
User moduleΒ  β†’

Last updated 2 days ago

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024