Summary

The current implementation of the permission handling can lead to some confusing scenarios where e.g. plan permissions get bypassed by global permissions.

The interaction of these two permission levels should be redesigned.

Scenario

1. Create 2 groups - read-only and portfolio-editor.
2. Grant read-only group with Portfolio Viewer permission in Portfolio global permission.
3. Grant portfolio-editor group with Portfolio User permission in Portfolio global permission.
4. Create 2 users - User A and User B.
5. Put User A in read-only and User B in portfolio-editor.
6. Create a Portfolio plan.
7. Configure the plan's permission to give only User B for Viewers.
8. Login with User A and try to access the plan. It is allowing this user to view it regardless of the plan's permission.
9. Add portfolio-editor group to plan's permission Editors.
10. Now, User A will be blocked from accessing the plan.

Expected Behavior

Portfolio should only allow User B to access the plan without the need of setting a group for Editors to enforce the permission.