Regression: Cannot hide a layer from a Viewer that's in a group of Viewers with latest dev

[tudorbarascu]

Checklist

• I've searched through the existing issues and this bug has never been reported before

Subject of the issue

I have a project with 2 layers: layer_1 and layer_2 and I want a viewer user that's in a group of viewer users to see just the layer2 using ONLY group permissions (if I do it using the user permissions it works)

I cannot do that using just the group permissions.
I need to add the specific username to the project ACL in order to work which it's bad when managing lots of users - I want the viewer user to inherit the group permissions.

Steps to reproduce

I tested this with the latest dev, but on branch 3.6.x it works.

I added a demo project to https://workshop.qcooperative.net/ (admin and qcooperative as login/pass) that holds the two layers. I created 2 users: viewer-in-a-group and viewer-not-in-a-group with the same password (qcooperative) and I added the viewer-in-a-group to a viewer-group called demo-viewers.

I created a workshop group and I added the following permissions: (one thing I noticed is that the checkbox with (Propagate NEW viewers and new viewers user groups permissions) doesn't get stored as when I get back to it it shows unchecked)

I created the project with the following permissions:

Whatever I do to hide layer_2 using ONLY group permissions doesn't work and the viewer-in-a-group is seeing both layers.

Environment

[g3wsdk.info]

• g3w-admin: 3.7.dev-20231127085907
• g3w-client: 3.9.0-alpha.2.0
• browser: Chrome 119.0.0.0
• operating system: OS X 10.15.7 64-bit

Link to your project

https://workshop.qcooperative.net/en/map/seminar/qdjango/26/

Additional info

No response

[Raruto]

Environment

latest dev just built

Hi @tudorbarascu,

please be more specific about that. You can get admin version (among others) by running g3wsdk.info() on the front side 👉 https://workshop.qcooperative.net/en/map/seminar/qdjango/26/

[wlorenzetti]

Hi @tudorbarascu , I thunk is not a regression, the behavior changed after this PR #666 witch fixed this issue #663

The issue is related to use of Anonymous User, if a Anonymous has grant on a project every layer can be shown, the Anonymous user must have precedence

[tudorbarascu]

Ok! I thought I could hide some layers for the Logged-in Users. In this case the business use is to see the advanced layer only as the simple one (that the anonymous users see) is not needed.

Is there any workaround?

[g3wsdk.info]

• g3w-admin: 3.7.dev-20231127085907
• g3w-client: 3.9.0-alpha.2.0
• browser: Chrome 119.0.0.0
• operating system: OS X 10.15.7 64-bit