Bug description
What happened?
When a User is assigned to a Group, Statamic creates two separate database relations: one in group_user (linking the user to the group) and another in role_user (linking the user directly to each role that belongs to that group). Because these two relations are stored independently, Statamic has no way of knowing whether a role assignment came from a Group or was assigned directly to the user.
As a result, removing a User from a Group does not remove the roles that were granted through that Group, and the roles remain assigned to the user in role_user, orphaned from the group relationship.
This makes the "Groups" feature less reliable for role management, since editing a user requires manually updating both the Roles field and the Groups field to get the expected result.
It also makes it impractical to bulk-move multiple users from one group to another, since the Assign Groups dialog doesn't provide a way of removing the old group and thus clean up the roles previously granted.
What did you expect to happen?
When removing a User from a Group, the roles that were granted solely through that Group should also be removed (or at least the relationship should be tracked so the UI/relations accurately reflect group-derived vs. directly-assigned roles).
When I'm using a file driver instead of eloquent the Roles field isn't set when a User is assigned to a Group, thus avoiding the issue above.
How to reproduce
- Create two roles (e.g. Role 1, Role 2).
- Create a Group (e.g. Group 1) and assign Role 1 to it.
- Create another Group (e.g. Group 2) and assign Role 2 to it.
- Create/edit a User and assign them to Group 1 via the "Groups" field.
- Save the user, then reload the page - note that Role 1 also appear checked under the "Roles" field.
- Edit the User again, unlink them from Group 1 and add then to Group 2 (leaving "Roles" untouched).
- Save and reload - the user has both Role 1 and Role 2 assigned, even though they are no longer in Group 1.
Logs
Environment
Environment
Laravel Version: 13.25.0
PHP Version: 8.4.23
Composer Version: 2.10.1
Environment: local
Debug Mode: ENABLED
Maintenance Mode: OFF
Timezone: UTC
Locale: en
Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED
Drivers
Broadcasting: log
Cache: file
Database: mysql
Logs: stack / single
Mail: log
Queue: sync
Session: file
Storage
public/storage: NOT LINKED
Statamic
Addons: 1
License Key: Set
Sites: 1
Stache Watcher: Enabled (auto)
Static Caching: Disabled
Version: 6.27.1 PRO
Statamic Addons
statamic/eloquent-driver: 5.11.0
Statamic Eloquent Driver
Addon Settings: eloquent
Asset Containers: eloquent
Assets: eloquent
Blueprints: eloquent
Collection Trees: eloquent
Collections: eloquent
Entries: eloquent
Fieldsets: eloquent
Form Submissions: eloquent
Forms: eloquent
Global Sets: eloquent
Global Variables: eloquent
Navigation Trees: eloquent
Navigations: eloquent
Revisions: file
Sites: eloquent
Taxonomies: eloquent
Terms: eloquent
Tokens: eloquent
Additional details
Bug description
What happened?
When a User is assigned to a Group, Statamic creates two separate database relations: one in
group_user(linking the user to the group) and another inrole_user(linking the user directly to each role that belongs to that group). Because these two relations are stored independently, Statamic has no way of knowing whether a role assignment came from a Group or was assigned directly to the user.As a result, removing a User from a Group does not remove the roles that were granted through that Group, and the roles remain assigned to the user in
role_user, orphaned from the group relationship.This makes the "Groups" feature less reliable for role management, since editing a user requires manually updating both the Roles field and the Groups field to get the expected result.
It also makes it impractical to bulk-move multiple users from one group to another, since the Assign Groups dialog doesn't provide a way of removing the old group and thus clean up the roles previously granted.
What did you expect to happen?
When removing a User from a Group, the roles that were granted solely through that Group should also be removed (or at least the relationship should be tracked so the UI/relations accurately reflect group-derived vs. directly-assigned roles).
When I'm using a
filedriver instead ofeloquentthe Roles field isn't set when a User is assigned to a Group, thus avoiding the issue above.How to reproduce
Logs
Environment
Additional details