Weblate keeps forgetting the "Add new projects" permission

[Bubu]

Describe the bug

I've enabled the "Add new projects" for the power user role in my weblate instance, which is assigned to every registered user. I now happened twice already that people contacted me that they couldn't create new projects and it turned out that I had to re-add the permission to the role. I don't know what exactly triggers the reset of the role, possibly a weblate update?

Expected behavior

The permission stays in place.

Server configuration and status

Weblate installation: from source as an archlinux package: https://aur.archlinux.org/packages/weblate/

 * Weblate: 4.3.2
 * Django: 3.1.3
 * siphashc: 2.1
 * Whoosh: 2.7.4
 * translate-toolkit: 3.2.0
 * lxml: 4.6.1
 * Pillow: 7.2.0
 * bleach: 3.2.1
 * python-dateutil: 2.8.1
 * social-auth-core: 3.4.0
 * social-auth-app-django: 4.0.0
 * django-crispy-forms: 1.9.2
 * oauthlib: 3.1.0
 * django-compressor: 2.4
 * djangorestframework: 3.12.2
 * django-filter: 2.4.0
 * django-appconf: 1.0.4
 * user-agents: 2.2.0
 * filelock: 3.0.12
 * setuptools: 50.3.2
 * jellyfish: 0.8.2
 * openpyxl: 3.0.5
 * celery: 4.4.7
 * kombu: 4.6.11
 * translation-finder: 2.5
 * weblate-language-data: 2020.11
 * html2text: 2020.1.16
 * pycairo: 1.20.0
 * pygobject: 3.38.0
 * diff-match-patch: 20200713
 * requests: 2.24.0
 * django-redis: 4.12.1
 * hiredis: 1.1.0
 * sentry_sdk: 0.19.2
 * Cython: 0.29.21
 * misaka: 2.1.1
 * GitPython: 3.1.11
 * borgbackup: 1.1.14
 * pyparsing: 2.4.7
 * Python: 3.8.6
 * Git: 2.29.2
 * psycopg2: 2.8.6
 * chardet: 3.0.4
 * ruamel.yaml: 0.16.12
 * git-svn: 2.29.2
 * Redis server: 6.0.9
 * PostgreSQL server: 12.4
 * Database backends: django.db.backends.postgresql
 * Cache backends: default:RedisCache, avatar:FileBasedCache
 * Email setup: django.core.mail.backends.smtp.EmailBackend: localhost
 * OS encoding: filesystem=utf-8, default=utf-8
 * Celery: redis+socket:///var/run/redis/redis.sock?virtual_host=1, redis+socket:///var/run/redis/redis.sock?virtual_host=1, regular
 * Platform: Linux 5.9.6-arch1-1 (x86_64)

Weblate deploy checks

System check identified some issues:

WARNINGS:
?: (weblate.W025.ass) Failure in loading handler for ass file format: aeidon or gaupol package required for Subtitle support
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.ini) Failure in loading handler for ini file format: Missing iniparse library.
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.islu) Failure in loading handler for islu file format: Missing iniparse library.
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.laravel) Failure in loading handler for laravel file format: No module named 'phply'
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.php) Failure in loading handler for php file format: No module named 'phply'
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.srt) Failure in loading handler for srt file format: aeidon or gaupol package required for Subtitle support
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.ssa) Failure in loading handler for ssa file format: aeidon or gaupol package required for Subtitle support
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W025.sub) Failure in loading handler for sub file format: aeidon or gaupol package required for Subtitle support
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#optional-deps
?: (weblate.W033.Gerrit) Failure in loading VCS module for Gerrit: git: 'review' is not a git command. See 'git --help'.
 (1)
	HINT: https://docs.weblate.org/en/weblate-4.3.2/vcs.html
?: (weblate.W033.Mercurial) Failure in loading VCS module for Mercurial: [Errno 2] No such file or directory: 'hg'
	HINT: https://docs.weblate.org/en/weblate-4.3.2/vcs.html

INFOS:
?: (weblate.I021) Error collection is not set up, it is highly recommended for production use
	HINT: https://docs.weblate.org/en/weblate-4.3.2/admin/install.html#collecting-errors

System check identified 11 issues (1 silenced).

[nijel]

The built-in roles are AFAIK reset on upgrade, though this doesn't seem to be documented anywhere...

[github-actions]

Thank you for your report, the issue you have reported has just been fixed.

• In case you see a problem with the fix, please comment on this issue.
• In case you see a similar problem, please open a separate issue.
• If you are happy with the outcome, don’t hesitate to support Weblate by making a donation.

[Bubu]

Thanks for your continued work on weblate ❤️, I have one question regarding this change:

Trying to recreate the desired workflow (every registered user can create new projetcs), I did the following now.

I created a new role that has only the create projects permission and assigned this role to the 'Users' group in addition to the 'Power users' role.

Is this now expected to survive updates? (i.e. editing a built-in group is okay)

[nijel]

Yes, this should work fine. The roles created by Weblate will be updated on upgrades, the custom ones will stay untouched. The group roles or attributes are not changed on upgrade. Generally, things you are not supposed edit should not be editable in the admin interface, but it was not properly done for the built-in roles. I've just clarified this in the docs as well.