:thumbsup:

We tried to respect the idea behind the commit 9c3eac88bf0ece1804f95006ba9e38a504cda006 that changed this method while still fixing it for this use-case

Shouldn't user.groups be identical to flask.g.fas_user.groups?

Fun one, sorry.

They are not the same, fas_user.groups is filled in upon login while user.groups is retrieved from the DB.
I think that's why the original logic of this method was relying on username and checking the group members rather than checking groups as we do now

Given all the confusions with the user objects vs flask.g.fas_user, maybe we should just make a flask.g.user that is the literal get_user() object, and go through the code and replace every instance of fas_user with that?

ack with idea for improvements for future PR.

Given all the confusions with the user objects vs flask.g.fas_user, maybe we should just make a flask.g.user that is the literal get_user() object, and go through the code and replace every instance of fas_user with that?

We'll need to be careful doing this (if you don't support group locally and are using openid, for example in dist-git, then you really want fas_user) but I like the idea :thumbsup: