Handle multiple access levels when updating permission_attributes.

[jonathandixon]

Fixes #422

When a user or group has multiple access permissions on an object, the permissions are incorrectly updated when saving permission_attributes.

Changes proposed in this pull request:

Instead of trying to associate the new permission_attributes with existing permissions, reverse this so existing permissions are associated with the new permission attributes. This ensures that no more than 1 new permission_attribute is updating an existing permission.

@projecthydra/hydra-contributors

[jcoyne]

I think you’ve changed the expected behavior of permissions, where each user can only have one access on an object. Currently having edit access implies read access. So, this seems like a breaking change to me.

[jonathandixon]

I suppose that if the expected behavior is that a user can only have one access on an object, then part of the fix should prevent a client from doing something like this:

target.edit_users += ['user1']
target.read_users += ['user1']

But fixing this could also be a breaking change.

Right now, I'm not sure how to best approach this.

[cjcolvar]

The Renaming Branch Working Group is in the process of renaming the default branch from master to main in Samvera and Samvera-Labs repos. This brings repositories into compliance with the Samvera Community Code of Conduct (https://samvera.atlassian.net/wiki/spaces/samvera/pages/405212316/Code+of+Conduct) and language recommendations (https://github.com/samvera/maintenance/blob/master/templates/CONTRIBUTING.md#language). Background on the renaming effort is available in the working group notes (https://samvera.atlassian.net/wiki/x/b5IYHg).

I updated the default branch name for hydra-head which had the side effect of closing your pull request. Please reopen this pull request targeting the main branch if it is still relevant. Thanks!