Open
Description
When posting a custom role, invalid permissions are omitted by the backend:
coder/enterprise/coderd/roles.go
Lines 154 to 156 in 0f15263
This was done to prevent an unsolvable error. If an invalid permission was to exist (via some migration or other means). The custom role could never be updated via the UI, as the permissions do not exist to "uncheck".
The solution was to ignore invalid permissions. This has the downside of silently removing things, which could be intuitive.
Invalid permissions should have some UX, maybe a warning?