Assigning tag-based permissions makes all other permissions in the same scope tag-based

[rolodato]

How are you running Flagsmith

• Self Hosted with Docker
• Self Hosted with Kubernetes
• SaaS at flagsmith.com
• Some other way (add details in description below)

Describe the bug

The /projects/<id>/my-permissions and /environments/<id>/my-permissions endpoints return permissions in this format:

{
  "permissions": [],
  "admin": false,
  "tag_based_permissions": [
    {
      "permissions": [
        "VIEW_ENVIRONMENT",
        "APPROVE_CHANGE_REQUEST",
        "CREATE_CHANGE_REQUEST"
      ],
      "tags": [
        9635,
        9589
      ]
    }
  ]
}

This association between permissions and tags is not correct. Each permission is should be associated with a set of tags that it's valid for, but this response groups all tags and permissions together. It's not possible to tell which tags are being used for which permission(s).

Authorisation is still being enforced correctly by the API, but these responses cause the frontend to show incorrect permissions to users.

Steps To Reproduce

1. Assign a user "View Project" and "Create Feature" permissions. These will be their project-level my-permissions:

{
  "permissions": [
    "VIEW_PROJECT",
    "CREATE_PROJECT"
  ],
  "admin": false,
  "tag_based_permissions": []
}

The user can then create and modify features as normal.

2. Assign the same user "Delete Feature" permissions for only a specific tag. Now, project-level my-permissions returns:

{
  "permissions": [],
  "admin": false,
  "tag_based_permissions": [
    {
      "permissions": [
        "VIEW_PROJECT",
        "DELETE_FEATURE",
        "CREATE_FEATURE"
      ],
      "tags": [
        9589
      ]
    }
  ]
}

Now, the frontend no longer allows editing this feature (ignore the unrelated permissions being returned here):

Expected behavior

Represent associations between tags and permissions correctly in the project and environment-level my-permissions API. Render these permissions correctly in the frontend.

Screenshots

No response

[kyle-ssg]

Ok yeah upon replicating it seems like the my-permissions endpoint should be returning

{
  "permissions": ["CREATE_FEATURE"], //this
  "admin": false,
  "tag_based_permissions": [
    {
      "permissions": [
        "VIEW_PROJECT",
        "DELETE_FEATURE",
      ],
      "tags": [
        9589
      ]
    }
  ]
}

It does appear that roles/:id/projects-permissions is behaving as expected (maintaining separate tags per permission), so it's just the my-permissions endpoint that's broke.

[rolodato]

This also breaks managing segments if any "Granted for tags" permission is selected (with at least 1 tag):