I wonder if we should exclude admin, or possibly others based on a flag or similar.

I think grantPermission and revokePermission will need some updates to their sanity checks.

I'm wondering if the JOIN in the new perms query needs to be a left join

Also, I'm thinking admins will need an easy way to figure out exactly where inherited perms are coming. This would likely require a new option to provide without breaking the getUserPerms api

1) I would handle them in same way just for the comprehensibility.
2) fixed
3) fixed
4) Do you mean new option for getUserPerms (extending to get_user_perms returning [{'name': 'admin', 'id': 1, 'source': None/group_id}] or new call?

My concern is this makes it too easy to grant admin to a very large group of people with a single erroneous command

Do you mean new option for getUserPerms (extending to get_user_perms returning [{'name': 'admin', 'id': 1, 'source': None/group_id}] or new call?

I could go either way on this. Main thing is not to duplicate the underlying query code. We have a tendency to introduce options and polymorphism, but I suppose a new call might be a little cleaner looking.

We're still duplicating the query code. When I wrote the above, I'd kind of envisioned having a single query call that returns the greater detail and have get_user_perms be a compat wrapper for that call

:thumbsup:

Commit 7f8c75d9 fixes this pull-request