apache / apache/grails-core

Grails 7, Dynamically adding role to user doesn't work.

Open
#15,847 4 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

I am not sure which one is at fault 'grails-spring-security:7.0.0-RC2' or 'grails-spring-security-ui:7.0.0-RC2'.
**Without restarting my app or re-login**:
I expect for example, I can add the ROLE_SUPERVISOR to a user and then in GSP i can use and it works.
The same way removing a ROLE. If i remove the ROLE_SUPERVISOR from user should prevent user from seeing enclosed section.

### Actual Behaviour

Add or remove ROLE from a user. Data is changing in USER_ROLE in H2 DB.
But this change in USER_ROLE has no effect on

It looks like USER_ROLE not updating in cache

### Steps To Reproduce

1. create an app with plugins 'grails-spring-security:7.0.0-RC2' and 'grails-spring-security-ui:7.0.0-RC2'
2. add a user Admin and two Roles ROLE_ADMIN. Using BootStrap.groovy
3. create a gsp. Add a section.
4. Start app.
5. Everything works OK.
6. Go to grails-spring-security-ui console in browser
7. add ROLE_SUPERVISOR to Admin user in the console
8. in GSP change role 9. reload GSP page in browser
10. **nothing will show up**
11. logout
12. login
13. go to GSP page. It is working now. Content in showes up

It seems the USER_ROLE in the cache is not updating ### Environment Information

java=21.0.8-zulu
gradle=8.14.3
groovy=4.0.28
grails=7.0.0-RC2

### Example Application

https://github.com/arjangch/grails-project-helper/tree/main/example3

### Version

7.0.0-RC2

Contributor guide

Open the contributing guide

Research direction

Start with the example3 application and reproduce the behavior using the grails-spring-security and grails-spring-security-ui 7.0.0-RC2 plugins, focusing on the GSP sec:ifAllGranted tag and USER_ROLE changes. Compare authorization before and after adding or removing a role, including the difference between reloading the page and logging in again; done means the tag reflects the database change without logout or re-login.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, spring
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.