[Bug] Daily cron jobs silently reset all role permissions, discarding admin changes

Open
  • Is something wrong?
#99 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
django, python
Domain
authorization, backend

Research direction

Start by locating CRON_CLASSES, task_sync_global_permissions, task_sync_role_permissions_to_default, and task_sync_role_permissions, then read the permission model documentation mentioned in the issue. Compare the scheduled syncs with the Admin Tasks actions and determine which policy the project should adopt: opt-in syncing, documenting locked defaults, or supporting local extensions. Done means the chosen policy prevents unexpected permission loss and is reflected in behavior or documentation, with removals logged if appropriate.

Written by the indexing model from the issue text.

Description

Summary

CRON_CLASSES runs three permission tasks every day at 07:30:

  • task_sync_global_permissions: for every Global: * group, sync_global_permissions() calls self.permissions.clear(), then re-adds only what GlobalRoles.PERMISSIONS lists.
  • task_sync_role_permissions_to_default: for every default unit role, sync_default_permissions() calls self.permissions.clear(), then re-adds UnitRoles defaults.
  • task_sync_role_permissions: re-syncs unit members' guardian permissions from their roles.

The same actions are also on the Administration → Admin Tasks menu for staff users.

Impact

  • Changes don't last: anything an administrator changes on a global group or a default unit role (in Django admin or the shell) is silently undone at 07:30 the next morning.
  • Workarounds for missing permissions fail: for example, adding awarding-body permissions to Global: Admin lasts less than a day.
  • Nothing warns about it: there's no log entry, no activity record and no note in the docs. The "Permission Model" docs say the matrix views "surface any drift", but drift is erased daily.

Suggested fix

Any of these:

  • Make it opt-in: keep the code definitions as the single source of truth, but only resync on deploy (post_migrate) or on demand, not daily.
  • Document it: say that global and default-role permissions can't be customised and changes are overwritten, and stop admins editing those groups in the Django admin.
  • Support local changes: add a setting such as GLOBAL_ROLE_EXTRA_PERMISSIONS = {"Admin": ["jobtracker.add_awardingbody", ...]} that the sync merges in, so sites can extend roles without forking.

Whichever is chosen, it would help to log each permission the sync removes.

Dominant language
HTML
Stars
6
Forks
4
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from brainthee/CHAOTICA

All issues in brainthee/CHAOTICA

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.