problems with permissions and groups

Describe the bug
When i create a folder and add some bookmarks in it and share it with someone, then withdraw the share (remove that person from the sahred list), he can still see the folder that was shared with him but not the bookmarks inside. also, i have noticed another problem, when i share a folder with a group (lets say group A) then the persons inside group A will be able to see the folder, but if i share the folder with group B, the people in group A (if they also happend to be in group B) will see the folders doubled (as in they will see two copies of the folder) and even if i remove these persons from the both groups, they are still able to see the folders.

To Reproduce
Steps to reproduce the behavior:

1. create a folder and create a bookmark inside it
2. share the folder with another person
3. remove the sahre with that person
4. he still sees the folder (but not the bookmark inside it)

Steps to reproduce second bug

1. create a folder with bookmarks
2. share the folder with a group that contains person A
3. share the folder with another group that has the same person (Person A)
4. in person A bookmarks see the folder two times

Expected behavior
for Bug 1: the user shouldnt be able to see the folder after access has been withdrawn
for Bug 2: the person in both groups should only be able to see the folder once

Screenshots
i have shared this file with two groups and the person seeing the folders is in both groups and as you can see, he says the folder and bookmarks twice.

Desktop (please complete the following information):

• OS: all
• Browser: all
• Version: latest

Server (please complete the following information):

• OS: linux
• HTTP server: [e.g. nginx 1.1]
• Database: [e.g. MySQL 5.3]
• PHP version: [e.g. v7.2]
• Nextcloud version: [e.g. 15.0.1 (see Nextcloud admin page)]
• Bookmarks app version: latest [16.2.4]
• Activated Nextcloud Apps: [the output of running $ sudo -u www-data php occ app:list in your command line]
• Nextcloud configuration: [the output of running sudo -u www-data php occ config:list system]
• Nextcloud external user backend: [e.g. ldap, or none]

Additional context
there is something i would like to add in relation to bug 2, when i remove that person A from one of the groups that can see the bookmark folder, the first time i get an internal server error and only after i click the second time to remove them i could remove them (but they still the folders twice). here is the log

Exception Call to a member function getId() on int in file '/var/www/html/custom_apps/bookmarks/lib/Hooks/UsersGroupsCirclesListener.php' line 152 /var/www/html/lib/private/AppFramework/App.php Line 153 OC\AppFramework\Http\Dispatcher->dispatch( { "__class__": "OCA\\Provisioning_API\\Controller\\UsersController" }, "removeFromGroup" ) /var/www/html/lib/private/Route/Router.php Line 321 OC\AppFramework\App::main( "OCA\\Provisioning_API\\Controller\\UsersController", "removeFromGroup", { "__class__": "OC\\AppFramework\\DependencyInjection\\DIContainer" }, { "_route": "ocs.provisioning_api.users.removefromgroup", "userId": "test" } ) /var/www/html/ocs/v1.php Line 61 OC\Route\Router->match( "/ocsapp/cloud/users/test/groups" ) /var/www/html/ocs/v2.php Line 8 undefinedundefinedrequire_once( "/var/www/html/ocs/v1.php" ) Caused by Error Call to a member function getId() on int

Web server error log

Insert your webserver log here

Nextcloud log (nextcloud/data/nextcloud.log)

Insert your Nextcloud log here

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log 
c) ...

Start in lib/Hooks/UsersGroupsCirclesListener.php around line 152, then reproduce both folder-sharing cases with overlapping groups and withdrawn access. Check the Nextcloud application and web-server logs while removing a user from a group. Done means withdrawn users cannot see the folder, overlapping group membership produces one folder, and group removal does not raise the reported getId() error.