api.user.grant_roles: issue when no username is passed and obj is not None

[ale-rt]

Looking at

plone.api/src/plone/api/user.py

Lines 365 to 383 in a8361ed

	if user is None:
	user = get(username=username)
	# check we got a user
	if user is None:
	raise InvalidParameterError('User could not be found')
	if isinstance(roles, tuple):
	roles = list(roles)
	# These roles cannot be granted
	if 'Anonymous' in roles or 'Authenticated' in roles:
	raise InvalidParameterError
	if obj is None:
	actual_roles = get_roles(user=user)
	else:
	# only roles persistent on the object, not from other providers
	actual_roles = obj.get_local_roles_for_userid(username)
	roles = list(set(actual_roles) | set(roles))

It seems that calling api.user.grant_roles(user=user, obj=obj) will remove all the roles because we will invoke:

plone.api/src/plone/api/user.py

Line 382 in a8361ed

actual_roles = obj.get_local_roles_for_userid(username)

passing None as a username.

[ale-rt]

This needs a confirmation, I just got this suspect looking at the code.