Hi i am trying to update user role in a particular tenant where i am removing and adding the role. But permit is not updating the roles according.

Hi @Girija shankar, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.

Currently we are doing it first removing all assigned role

String tenant = resolveTenant(organizationId);

UserRead user = usersApi.get(userId);

RoleAssignmentRead[] assignedRoles = usersApi.getAssignedRoles(user.key);

for (RoleAssignmentRead assignedRole : assignedRoles) {
    if (tenant.equals(assignedRole.tenant)) {
       
        roleAssignmentsApi.unassign(
                new RoleAssignmentRemove(assignedRole.role, assignedRole.user)
                        .withTenant(tenant)
        );
    }
}

and then assigning the new one

String tenant = resolveTenant(organizationId);
UserRead user = usersApi.get(userId);

roleAssignmentsApi.assign(
        new RoleAssignmentCreate(AccountRole.OWNER.getValue(), user.key)
                .withTenant(tenant));

Thanks for tagging me @Or Weis. I'll look through relevant sources and get back to you shortly.

We'll be with you shortly

Based on the Java code you've shared, the issue appears to be with the role assignment persistence. Looking at the documentation, when assigning roles to users, the proper approach is to use the role assignment endpoints correctly. (1) (2) For Java, based on the pattern shown in the documentation, you should ensure you're using the correct API endpoints. The Ruby documentation shows a similar pattern for role assignments: (3)

role_assignment_create = OpenapiClient::RoleAssignmentCreate.new({role: 'role_example', tenant: 'tenant_example', user: 'user_example'})

To help our engineers investigate why roles aren't being properly updated: 1. Which Workspace / Project / Env are you using? 2. What exact SDK version and calls are you performing (please share the full code including imports) ? 3. Which PDP version are you running? 4. Could you share relevant logs from your PDP showing the unassign and assign operations? Additionally, please verify: • Are you checking the roles immediately after the operations, or is there a delay? • Can you confirm the unassign operation is returning successfully (check the response status) ? • Are there any error messages in your PDP logs during these operations? This information will help identify if this is a timing issue, a caching problem, or a potential bug in the role assignment flow.

If the problem you're experience is a race condition please be sure to use the consistent updates feature https://docs.permit.io/how-to/manage-data/local-facts-uploader/

Hey Girija, let me try to reproduce this and I'll get back with you.

Sure @Thomas thanks

Hey @Girija shankar can you provide the script? I think the role removal isn't completing before you start the add role. I think it's a timing thing on touching the object. I don't think consistent updates will help here. I think it's a timing thing on the API.

Hey @Girija shankar, just bumping this message so we can handle it.

Hey @Thomas , @Alon Boshi yes its the timing thing i introduced Thread.sleep for 1 second and it worked.

@Girija shankar that's good to hear and does suggest a timing issue with the API. Would you be willing to provide the full example code you ran so that we can try and replicate it on our end? Although the 1s wait is a good work around, our APIs should handle the calls you sent like you're trying to use them.