API: user permissions object empty

[Iizuki]

Summary

I upgraded from 8.0.X to 8.3.1 and somewhere in there the permissions field of a user appears to have broken.

So for instance

• GET /users
• GET /users/me

Format

First off the format changed from string ints to plain ints. I.e. it used to look like this

{
  "permisisons": {
    "superadmin": "1",
    "admin": "0",
    ...
  },
  ...
}

and now it's like this:

{
  "permisisons": {
    "superadmin": 1,
    "admin": 0,
    ...
  },
  ...
}

That's actually a step for the better IMO. Booleans would be even better.

This wasn't the real issue though.

Empty objects

The real issue is that the majority of users will return an empty object:

{
  "permisisons": {},
  ...
}

Sure enough they don't have any rights either, but this should be indicated as just having all the fields at 0. If you edit the permissions of such user the problem goes away. You'll get a full permissions object whether they have permissions or not.

So it appears like some db migration step might be lacking?

[snipe]

It's not a DB migration step, just an artifact of us fixing a bug where the values were being displayed as strings instead of numeric booleans. Users are not created with values in the permissions field by default - someone would have had to save their profile to set those values.

See also #16836

[Iizuki]

Thanks for the explanation. Good to know there's nothing wrong with the DB.

So I gather it wouldn't be too difficult to cook up an artificial zero-permissions object in the API if DB says there's no such thing?