Adding non-existent permissions to a role is not allowed.

@trickfun I don't think it's the module issue, as I was trying to recreate it and you are able to get this error only when you leave the permission page open while you remove legal document in new tab, and you try to save outdated permission page what leads to this error.
It's the only way I was able to recreate it, and it seems more like core's permission form issue and how it handles outdated forms, not the module. But maybe you can provide more details about steps to reproduce if your steps were different..

Okay so the issue is that permissions should be revoked when entity_legal_document config entity is deleted, and it's not. It leads this error to appear. It seems to be quite well known issue for multiple projects and I think the best solution is to add dependencies to our permissions in EntityLegalPermissions, it has been introduced here: https://www.drupal.org/node/3055548 → .
I've created fork issue and merge request.

I think it may be good to mention that this code fix the source, but it won't fix the error which appeared already. In this case we might need to prepare hook update which goes through roles and revoke permissions for deleted legal document entities already. Let me know if we need to do that as well in scope of the module.

Thank you for catching this.

• I think it needs a simple kernel test that created a document, sets the permission to a role. After the document is deleted, we have to assert that the permission has been removed from the role
• Indeed, we need an update path. Try and get some inspiration from entity_legal_post_update_9002().

@claudiu.cristea got it, I will code it.

@claudiu.cristea added simple kernel test, but second point does not make sense for me..

>Indeed, we need an update path. Try and get some inspiration from entity_legal_post_update_9002().

Why do we need to update path? Did you mean update existing roles permissions?

Why do we need to update path? Did you mean update existing roles permissions?

I was thinking that some sites might have already roles with stale permissions. But, indeed, it might be overkill to cover this scenario

@claudiu.cristea

That's the code which resolve stale permissions issue, I suppose we could put it into post_update hook.

  $legal_entities = array_keys(EntityLegalDocument::loadMultiple());
  $roles = Role::loadMultiple();
  foreach ($roles as $role) {
    $update = FALSE;
    $permissions = $role->getPermissions();
    foreach ($permissions as $permission) {
      preg_match("/^(legal view |legal re-accept )(.*)/", $permission, $match);
      $machine_name = $match[2] ?? NULL;
      // Check if there is legal entity matching to checked permission.
      if ($machine_name && !in_array($machine_name, $legal_entities)) {
        $role->revokePermission($permission);
        $update = TRUE;
      }
    }
    if ($update) {
      $role->save();
    }
  }

Let's not complicate. We're in alpha with 4. I will merge it as it is. Projects with such cases will have to deal manually with it

Automatically closed - issue fixed for 2 weeks with no activity.