Deck board shared with multiple circles causes permissions issues if some users are member of both circles

[muppeth]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Describe the bug
If a board is shared between Circle A (read only permissions) and Circle B (write and manage), and if a user is a member of both circles, he gets permissions of Circle A but not B. This results in user not being able to edit board unless that board is then re-shared with the user individually or user leaves circle A.

To Reproduce
Steps to reproduce the behavior:

1. Create circle A
2. Create circle B
3. Share deck board with circle A and do not allow edits or manage
4. Share deck board with circle B and allow edits and manage permissions
5. As a user (not owner of the deck board) join both circles and try to manage or edit deck board (eg. add tag)

Expected behavior
The permission of the circle that does allow for edits should be taken as the main one for user who's in both circles.

[rms-joe]

I did some further investigation on that issue today.

Findings:
Order of the circles is relevant. So first entry in the "share with" dropdown menu sets the given permission for the attendee.

Understanding how circles are ordered wasn't obvious, as they are ordered by their circle_id.

[rms-joe]

So to give a better understanding I'd like to describe our use case a bit. We have a public circle for the community that we give read only permission on our board, so people can follow what's going on and a closed circle with full permission for the admins. All admins are members of the public circle as we use it for other purposes as well. As we linked both circles to our board, admins weren't able to change anything anymore as the closed circle was ordered below the public circle.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[gerazo]

This is still a problem in NC23 Deck 1.6.0. In fact, it also happens between a Circle and a User. In this case, the permission earlier in the list decides (whether it is the Circle or the User item).

[joshtrichards]

Fixed in #3625