Why users removed from a group still have their privileges?

Support
9

Ah, found it.

app/models/group_user.rb has this

  def grant_trust_level
    return if group.grant_trust_level.nil?
    if user.trust_level < group.grant_trust_level
      user.change_trust_level!(group.grant_trust_level)
      user.trust_level_locked = true
      user.save
    end
  end

I guess having the code not set locked to true could be done.
But if it wasn’t locked then any that did not meet the requirements would lose TL3 after the grace period.

I’m thinking it would be less work to unlock removed members than it would be to re-promote group members - if that needed to be done. Maybe if the locking was changed it would cycle through revoke - grant when the job ran?