Problem/Motivation

At admin/group/types/manage/GROUP_TYPE/roles I created a new role with Insider scope that synchronizes with a global role called Event Editor. I then had both an Insider and Outsider scope that both synchronized with the global Event Editor role. The Outsider scope already existed.

Insider and Outsider scope for the same global role.

Using the new Insider scope, I was able to grant group members who had the global Event Editor role group level permissions regardless of what other group role they did or did not have. All was well. I wrote tests and confirmed they were passing.

I committed my work, and opened a PR that runs tests against a newly installed Drupal site. Tests passed. I merged the PR and deployed my work to a QA environment with an existing Drupal site/database. Config import failed on the QA environment with this error:

  The import failed due to the following reasons:                                                                                                                      
  Unexpected error during import with operation create for group.role.default_group-event_editor: The <em class="placeholder">Default Group</em&gt  
  ; group type already has a group role within the outsider scope for the <em class="placeholder">Event Editor</em> global role

So that leaves me with questions:

  1. Is this expected? Am I not supposed to add an Insider scope/group role that synchronizes with a global role that already has an Outsider scope?
  2. If it's expected, why does the UI allow me to do something that will cause config import to fail and why does config export work? Why does drush site install work but config import does not?
  3. If it's expected, how else can I achieve this: Group members who have the global Event Editor role have group level permissions regardless of what other group level role they do or don't have?
  4. If it's not expected, how can I fix it?

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#2 Screenshot 2026-01-02 at 12.05.03 PM.png45.53 KBmaskedjellybean

Comments

maskedjellybean created an issue. See original summary.

maskedjellybean’s picture

maskedjellybean
Location Portland, OR
commented
Issue summary: View changes
StatusFileSize
new Screenshot 2026-01-02 at 12.05.03 PM.png45.53 KB
maskedjellybean’s picture

maskedjellybean
Location Portland, OR
commented
Issue summary: View changes
maskedjellybean’s picture

maskedjellybean
Location Portland, OR
commented
Issue summary: View changes
maskedjellybean’s picture

maskedjellybean
Location Portland, OR
commented

Ok actually it seems that rerunning config import resolves the issue and config imports cleanly from then on.

So this is a bug but what kind is TBD.

Is the bug that config import throws an error on the first attempt? Or is the bug that we are able to create an Insider and Outsider scope that synchronizes with the same global role when we're supposed to pick one or the other? I hope it's the first since I don't know how else to achieve what I need.

But why would it even be possible to throw that error if it's expected that we can create an Insider and Outsider scope that synchronizes with the same global role? Yet it seems like that's exactly what is recommended in this issue:
https://www.drupal.org/project/group/issues/3425442

This is the only issue I can find where the same error is thrown:
https://www.drupal.org/project/group/issues/3311119