Config import fails when deleting invalid permissions

Thanks for finding that, that is related, but the opposite issue I think. In my case I'm trying to delete config that is invalid, in that issue they are trying to save it.

Thanks,
Nic

This issue needs more explicit steps to reproduce the problem. Here are the steps from the issue summary:

1. Create permissions on Drupal
2. Get them in user role config
3. Delete permission (not from role config)
4. Update to Drupal 10
5. Remove permission from user role config
6. Run config import (this will fail even though the change is to remove invalid config)

I guess we start with installing Drupal 9 before Step 1.

I guess I can do Step 1 by enabling a module, and Step 3 by uninstalling that module.

Step 5 should be automatic. There is an update function in Drupal 10 that removes invalid permissions.

What permissions are we trying to import in Step 6? If we exported configuration before Step 4 and try to import that, then it will cause problems. See #3358586-20: RuntimeException: Adding non-existent permissions to a role is not allowed → : after any upgrade that includes database updates, you should export configuration (and commit it to Git if you are tracking configuration).

Assuming that is the problem, I have simpler steps to reproduce:

1. Install Drupal 10 or Drupal 11.
2. Export configuration.
3. Edit user.role.authenticated.yml and add an invalid permission.
4. Import configuration.

But you seem to be saying that this is not the issue. Again, be more specific in Step 6: what configuration are you trying to import?

To add some additional context.

I ended up in a situation where I could not import config because I had an invalid permission in the configuration.
I manually edited the role file to remove the invalid configuration.
I then attempted to import the configuration and I could not.
I am speculating a bit because I was not the developer that got into the state with invalid permissions.

Developer B
The way I got there was have a module that defined a permission on Drupal 9
A role had that permission
Uninstall and remove the module
(I suspect run config import here)
I began work here
Update to Drupal 10
Try to import (fails)
Manually delete permission in yaml
Try to import (fails)

What I had to do was create a dummy module with the permissions and import.
The validator should allow removing invalid permissions from the db that are no longer defined in config.

With the updated issue description, the only config export I see is in Step 4. If that is the configuration you are trying to import in Step 8, then I would expect it to fail. As I said in Comment #5, you should always export (and commit) configuration after database updates.

Is there any reason to believe that the configuration failed in Step 10 because of the permissions that were removed? If you exported configuration before upgrading to Drupal 10, then there might be a lot of changes that never got exported.

Have you tested the steps in the issue summary? That is, are they actually steps to reproduce or are they just a (possibly incomplete) list of things that happened?

Yes, I know it failed due to that.

I ran the import, got a failure due to invalid config
I deleted the config manually and ran config import and it failed due to invalid config
I created a dummy module with two files info yml and a permissions yml
Running import succeeded
I then deleted the dummy module

Steps 1-4 are an educated guess
5 and 6 I saw in git
7-10 I did myself

I did the following test:

git restore comp*
git checkout 9.5.11
ddev composer require drush/drush
ddev drush si
ddev drush en foo
ddev drush role:perm:add authenticated 'custom foo permission'
ddev drush config:export
ddev drush pmu foo
rm -rf modules/foo/
ddev exec grep foo ../config/default/user.role.authenticated.yml
ddev drush config:get user.role.authenticated | grep foo
git restore comp*
git checkout 10.0.0
ddev composer require drush/drush
ddev drush updatedb
ddev drush config:import
ddev exec grep foo ../config/default/user.role.authenticated.yml
ddev drush config:get user.role.authenticated | grep foo
ddev exec sed -i '/foo/d' ../config/default/user.role.authenticated.yml
ddev drush config:import
ddev exec grep foo ../config/default/user.role.authenticated.yml
ddev drush config:get user.role.authenticated | grep foo
ddev exec sed -i '/foo/d' ../config/default/core.extension.yml
ddev drush config:import
ddev exec grep foo ../config/default/user.role.authenticated.yml
ddev drush config:get user.role.authenticated | grep foo

My custom module had this .info.yml file:

name: 'Foo'
type: module
description: 'Test module for permissions and upgrade.'
package: Custom
core_version_requirement: ^9 || ^10

and this .permissions.yml file:

custom foo permission:
  title: 'Custom Foo permission'

After I uninstalled (and removed) the module, the module dependency and the permission were both in the exported user.role.authenticated.yml, and neither was in the active configuration. I think I would have gotten the same result with any 9.3+, since we first deprecated invalid permissions in 9.3.0.

The first two times I tried to import configuration, it failed with the same message:

  The import failed due to the following reasons:                              
  Unable to install the <em class="placeholder">foo</em> module since it does  
   not exist.                                                                  

That is why I removed foo from core.extensions.yml. After I did that, the config import worked.

As I suggested in Comment #8, config import failed, but not because of the permissions.

If you still think there is a problem, then give complete steps to reproduce.