@@ -126,0 +164,4 @@
+                    
+                    An indirect role is a role FIXME.
+                */
+                create or replace function ${rawSubTable}_insert_permission_missing_tf()

@@ -66,2 +72,4 @@
         final var grants = rawGrantRepo.findByAscendingUuid(refUuid);
         grants.forEach(g -> {
+            if ( g.getDescendantIdName() == null ) {
+                // FIXME: what's that?

@@ -650,6 +691,11 @@ declare
     superRoleId uuid;
     subRoleId uuid;
 begin
+    -- FIXME: maybe separate method grantRoleToRoleIfNotNull(...)?

@@ -61,2 +61,3 @@
+        -- direct grants to users need a grantedByRole which can revoke the grant
         if grantedByRole is null then
-            grantedByRoleUuid := roleUuid;
+            userGrantsByRoleUuid := roleUuid; -- FIXME: or do we want to require an explicit userGrantsByRoleUuid?

@@ -109,3 +111,3 @@
     if NEW.customerUuid <> OLD.customerUuid then
 
-        call revokePermissionFromRole(findPermissionId(OLD.uuid, 'INSERT'), testCustomerAdmin(oldCustomer));
+        call revokePermissionFromRole(getPermissionId(OLD.uuid, 'INSERT'), testCustomerAdmin(oldCustomer));

@@ -209,13 +223,15 @@ create trigger test_package_insert_permission_check_tg
 call generateRbacIdentityViewFromProjection('test_package', $idName$