Issue #3039499 by alexpott, acbramley: Role permissions not sorted in config export

(cherry picked from commit 6b5efdc1)

core/modules/user/config/schema/user.schema.yml

@@ -122,6 +122,7 @@ user.role.*:
     permissions:
       type: sequence
       label: 'Permissions'
+      orderby: value
       sequence:
         type: string
         label: 'Permission'

core/modules/user/src/Entity/Role.php

@@ -185,12 +185,6 @@ public function preSave(EntityStorageInterface $storage) {
       });
       $this->weight = $max + 1;
     }
-
-    if (!$this->isSyncing()) {
-      // Permissions are always ordered alphabetically to avoid conflicts in the
-      // exported configuration.
-      sort($this->permissions);
-    }
   }
 
   /**

core/modules/user/tests/src/Kernel/UserRoleEntityTest.php

@@ -45,4 +45,16 @@ public function testGrantingNonExistentPermission() {
       ->save();
   }
 
+  public function testPermissionRevokeAndConfigSync() {
+    $role = Role::create(['id' => 'test_role', 'label' => 'Test role']);
+    $role->setSyncing(TRUE);
+    $role->grantPermission('a')
+      ->grantPermission('b')
+      ->grantPermission('c')
+      ->save();
+    $this->assertSame(['a', 'b', 'c'], $role->getPermissions());
+    $role->revokePermission('b')->save();
+    $this->assertSame(['a', 'c'], $role->getPermissions());
+  }
+
 }

core/modules/user/user.post_update.php

@@ -5,6 +5,9 @@
  * Post update functions for User module.
  */
 
+use Drupal\Core\Config\Entity\ConfigEntityUpdater;
+use Drupal\user\Entity\Role;
+
 /**
  * Implements hook_removed_post_updates().
  */
@@ -14,3 +17,14 @@ function user_removed_post_updates() {
     'user_post_update_update_roles' => '10.0.0',
   ];
 }
+
+/**
+ * Ensure permissions stored in role configuration are sorted using the schema.
+ */
+function user_post_update_sort_permissions(&$sandbox = NULL) {
+  \Drupal::classResolver(ConfigEntityUpdater::class)->update($sandbox, 'user_role', function (Role $role) {
+    $permissions = $role->getPermissions();
+    sort($permissions);
+    return $permissions !== $role->getPermissions();
+  });
+}