Problem/Motivation
When viewing a single role, there is no indication that certain permissions may already be applying to users with that role implicitly, because they are assigned to the authenticated user role. This can be confusing to those less familiar with how Drupal's permission system works.
Core disables permissions that are assigned to the authenticated role and puts a tooltip on those permissions indicating the permission is not selectable because it is already assigned to the authenticated user role.
This mechanism also works with this module but, crucially, only if the authenticated user role is also shown.
Essentially, this is the same as this fairly old issue:
#1206946: Filter permissions breaks inherited-permissions js →
. However, I would humbly try to raise this issue again, as I think it is a UX concern. I've actually "had" to undo a bunch of changes a customer made "because the role did not have all the permissions the authenticated user role has". (Of course "had" to undo maybe stretching it a little; no real harm is done. However, I like to keep things clean.)
Steps to reproduce
- Have a site with at least one extra role beyond the standard roles
- Assign at least one permission to the authenticated user role
- Filter the permissions screen on both the authenticated role and the additional role
- Notice that the permission(s) assigned to the authenticated role are disabled as illustrated above
- Now, only filter on the additional role
- Note that the permission(s) assigned to the authenticated role are no longer disabled and can be assigned to the role without problems
Proposed resolution
Reproduce the look of the disabled checkboxes when the authenticated user is on the screen. I believe the tooltip, together with the default behaviour of showing all permissions, are enough to lead users to understanding why certain permissions are "hard on".
Remaining tasks
- Agree this is a good idea
- Write the code
- Review
- Merge
User interface changes
* Check boxes for permissions already assigned to the authenticated user are selected and disabled, regardless of whether the anonymous user role is filtered on screen.
API changes
None.
Data model changes
None.