Repository: hasura/graphql-engine
File: console/src/components/Services/Data/TablePermissions/Actions.js (JavaScript)

Code before:
      permissionsUpQueries,
      permissionsDownQueries,
      migrationName,
      customOnSuccess,
      customOnError,
      requestMsg,
      successMsg,
      errorMsg
    );
  };
};

const permChangePermissions = changeType => {
  return (dispatch, getState) => {
    const allSchemas = getState().tables.allSchemas;
    const currentSchema = getState().tables.currentSchema;
    const permissionsState = {
      ...getState().tables.modify.permissionsState,
    };
    const prevPermissionsState = {
      ...getState().tables.modify.prevPermissionState,
    };
    const limitEnabled = permissionsState.limitEnabled;

    const table = permissionsState.table;
    const role = permissionsState.newRole || permissionsState.role;
    const query = permissionsState.query;

    const tableSchema = allSchemas.find(
      t => t.table_name === table && t.table_schema === currentSchema
    );
    const currRolePermissions = tableSchema.permissions.find(
      p => p.role_name === role
    );

    const permissionsUpQueries = [];
    const permissionsDownQueries = [];
    if (query === 'select' && !limitEnabled) {
      delete permissionsState[query].limit;
    }

    if (currRolePermissions && currRolePermissions.permissions[query]) {
      const deleteQuery = {
        type: 'drop_' + query + '_permission',
        args: {
          table: { name: table, schema: currentSchema },
          role: role,
        },
      };
      const createQuery = {
        type: 'create_' + query + '_permission',

Review comment (security):
This isn't a neat solution. permissionState.role needs to be the source of truth for what role we are setting permissions for. With this solution the display still shows the old role on the UI but applies to the updated value which is confusing.
![Screenshot from 2019-10-08 16-22-40](https://user-images.githubusercontent.com/54616969/66390236-e29a7000-e9e7-11e9-9124-cbc0b354c12b.png)


Better solution is to update value of permissionState.role also when newRole is updated if edit section is open

Code after:
      dispatch,
      getState,
      permissionsUpQueries,
      permissionsDownQueries,
      migrationName,
      customOnSuccess,
      customOnError,
      requestMsg,
      successMsg,
      errorMsg
    );
  };
};

const permChangePermissions = changeType => {
  return (dispatch, getState) => {
    const allSchemas = getState().tables.allSchemas;
    const currentSchema = getState().tables.currentSchema;
    const permissionsState = {
      ...getState().tables.modify.permissionsState,
    };
    const prevPermissionsState = {
      ...getState().tables.modify.prevPermissionState,
    };
    const limitEnabled = permissionsState.limitEnabled;

    const table = permissionsState.table;
    const role = permissionsState.role;
    const query = permissionsState.query;

    const tableSchema = allSchemas.find(
      t => t.table_name === table && t.table_schema === currentSchema
    );
    const currRolePermissions = tableSchema.permissions.find(
      p => p.role_name === role
    );

    const permissionsUpQueries = [];
    const permissionsDownQueries = [];
    if (query === 'select' && !limitEnabled) {
      delete permissionsState[query].limit;
    }

    if (currRolePermissions && currRolePermissions.permissions[query]) {
      const deleteQuery = {
        type: 'drop_' + query + '_permission',
        args: {
          table: { name: table, schema: currentSchema },
          role: role,
        },
      };