[Bug]: Existing permission group users are removed when group is updated

[dylang3]

Snipe-IT Version

Version v8.3.6 - build 20551 (master)

PHP Version

8.4.11 (web), PHP 8.4.11 (cli)

Composer Version

2.8.12

MySQL/MariaDB version

MySQL 8.0.42

How did you install Snipe-IT?

Git install

Is this a fresh install or an upgrade?

Upgrade

What happened?

It appears that existing permission group users are not being retained when the group is updated (unless you're also adding or removing users). One of our admins ran into this the hard way earlier today 😅

I believe I've identified the cause and will have a PR with a proposed fix up shortly, but I wanted to go ahead and open an issue first to document the bug, especially since it could be a bit of a headache for anyone who doesn't have good backups of their group members.

Example

The permission group below initially has two users. After updating any of the group fields (except for the users in the group), the two users no longer appear in the group.

After updating a field (the group name, in this example), the group no longer has any members:

What browsers are you seeing the problem on?

Chrome

Can you reproduce this on the public demo?

No

Do you have full multiple company support enabled?

No

If you have full multiple company support enabled, do you have location scoping to company enabled?

I do not have full multiple company support enabled

Application log output

Browser console output

Common Issues

• [x] I have searched this repo for existing issues related to my issue (including closed issues)
• [x] My APP_URL is set correctly in my .env file (including http or https and no trailing slash)
• [x] I have searched the official Snipe-IT documentation and have checked the Common Issues documentation (where applicable)
• [x] I have run database migrations (where applicable).
• [x] I have attached screenshots and/or videos of the issue (where applicable)

Code of Conduct

• [x] I agree to follow this project's Code of Conduct