Trying to update a share permissions role of a shared resource to a disabled role is possible

[PrajwolAmatya]

Describe the bug

When updating a share permissions role of a shared resource to any disabled role, the result is success.

Steps to reproduce

1. user Alice create a folder folderToShare
2. Alice shares folder folderToShare with any enabled share permissions role, for example, Viewer
3. Alice updates the share permissions role which is not enabled, for example, Secure Viewer

curl -kv -XPATCH 'https://localhost:9200/graph/v1beta1/drives/<drive-id>/items/<item-id>/permissions/<permissions-id>' \
-u alice:123456 \
-d '{
    "roles": [
        "aa97fe03-7980-45ac-9e50-b325749fd7e6"
    ]
}'

Actual behavior

The share update shows the successful result, the role is not assigned as the roles property is not listed in the response instead the response contains the available permissions actions.

{
    "@libre.graph.permissions.actions": [
        "libre.graph/driveItem/path/read",
        "libre.graph/driveItem/children/read",
        "libre.graph/driveItem/basic/read"
    ],
    "createdDateTime": "2024-12-13T12:11:31.544516667+05:45",
    "grantedToV2": {
        "user": {
            "@libre.graph.userType": "Member",
            "displayName": "Brian Murphy",
            "id": "1480417a-dbe1-4058-a511-99682915970c"
        }
    },
    "id": "d5727cf1-f2ea-4a4a-9725-0b97d9068c73:670bcf96-8fdb-4945-879b-3646dbb65f88:5fd78b77-4440-4cfa-be96-c5eff6d5816c",
    "invitation": {
        "invitedBy": {
            "user": {
                "@libre.graph.userType": "Member",
                "displayName": "Alice Hansen",
                "id": "670bcf96-8fdb-4945-879b-3646dbb65f88"
            }
        }
    }
}

Expected behavior

Not sure what should be the expected behavior. Is the current behavior valid or should the update fail?

[micbar]

This is expected behavior.

Clarification

1. Roles are just "permission sets"-
2. Users can theoretically directly use the "available actions" to set individual permissions on a share or space membership.
3. The backend validates the request and enforces that only "lower or equal" permissions of the sharer are granted to the receiver.

[PrajwolAmatya]

This is expected behavior.

Closing this issue as the current behavior is the expected one.