From 077bac99ae6ce4e7c95289837e60613b0c89388c Mon Sep 17 00:00:00 2001
From: Meik <meik.drechsler@consulting4it.de>
Date: Fri, 10 Jul 2026 08:46:08 +0200
Subject: [PATCH] Avoid own permission groups in traverse group

---
 LiamNtfs/C4IT_IAM_SET/DataArea_FileSystem.cs | 99 +++++++++++---------
 1 file changed, 54 insertions(+), 45 deletions(-)

diff --git a/LiamNtfs/C4IT_IAM_SET/DataArea_FileSystem.cs b/LiamNtfs/C4IT_IAM_SET/DataArea_FileSystem.cs
index d01ae81..9e62587 100644
--- a/LiamNtfs/C4IT_IAM_SET/DataArea_FileSystem.cs
+++ b/LiamNtfs/C4IT_IAM_SET/DataArea_FileSystem.cs
@@ -571,7 +571,8 @@ namespace C4IT_IAM_SET
                 var currentTraverseLevel = lvl;
                 var defaultTraverseLoopIndex = lvl;
                 var hasTraverseBoundary = !string.IsNullOrWhiteSpace(GetNormalizedTraverseBoundaryPath());
-                var processedNearestTraverseParent = false;
+                var sourcePath = NormalizeDirectoryPath(newDataArea.IAM_Folders[0].technicalName);
+                var sourcePermissionGroupsAdded = false;
 
                 // Überprüfen der Templates
                 if (templates == null)
@@ -935,64 +936,72 @@ namespace C4IT_IAM_SET
                     if (parentTraverseGroup != null || !string.IsNullOrWhiteSpace(parentTraverseGroupName))
                     {
                         var displayTraverseGroupName = parentTraverseGroup?.Name ?? parentTraverseGroupName;
-                        if (!processedNearestTraverseParent)
+                        var isSourceTraversePath = PathsEqual(parent.FullName, sourcePath);
+                        if (!sourcePermissionGroupsAdded)
                         {
-                            DefaultLogger.LogEntry(LogLevels.Debug, "Verarbeite SecurityGroups bei oberster Ebene.");
-                            foreach (var currentSecGroup in newSecurityGroups.IAM_SecurityGroups)
+                            if (isSourceTraversePath)
                             {
-                                if (currentSecGroup == null)
+                                DefaultLogger.LogEntry(LogLevels.Debug, $"Skip direct permission group membership for own Traverse-Gruppe '{displayTraverseGroupName}' on '{parent.FullName}'.");
+                            }
+                            else
+                            {
+                                DefaultLogger.LogEntry(LogLevels.Debug, "Verarbeite SecurityGroups in erster uebergeordneter Traverse-Gruppe.");
+                                foreach (var currentSecGroup in newSecurityGroups.IAM_SecurityGroups)
                                 {
-                                    DefaultLogger.LogEntry(LogLevels.Error, "currentSecGroup ist null.");
-                                    continue;
-                                }
-                                if (currentSecGroup.Scope != GroupScope.Global)
-                                    continue;
-                                if (IsSameGroupName(currentSecGroup.Name, displayTraverseGroupName))
-                                {
-                                    DefaultLogger.LogEntry(LogLevels.Debug, $"Skip self membership for Traverse-Gruppe '{displayTraverseGroupName}'.");
-                                    continue;
+                                    if (currentSecGroup == null)
+                                    {
+                                        DefaultLogger.LogEntry(LogLevels.Error, "currentSecGroup ist null.");
+                                        continue;
+                                    }
+                                    if (currentSecGroup.Scope != GroupScope.Global)
+                                        continue;
+                                    if (IsSameGroupName(currentSecGroup.Name, displayTraverseGroupName))
+                                    {
+                                        DefaultLogger.LogEntry(LogLevels.Debug, $"Skip self membership for Traverse-Gruppe '{displayTraverseGroupName}'.");
+                                        continue;
+                                    }
+
+                                    if (WhatIf)
+                                    {
+                                        resultToken.warnings.Add($"Traverse-Gruppe '{displayTraverseGroupName}' würde Mitglied '{currentSecGroup.Name}' erhalten.");
+                                        continue;
+                                    }
+
+                                    if (!TryEnsureGlobalGroupMembershipWithRetry(domainContext, parentTraverseGroup, currentSecGroup))
+                                        continue;
                                 }
 
-                                if (WhatIf)
-                                {
-                                    resultToken.warnings.Add($"Traverse-Gruppe '{displayTraverseGroupName}' würde Mitglied '{currentSecGroup.Name}' erhalten.");
-                                    continue;
-                                }
+                                sourcePermissionGroupsAdded = true;
+                            }
+                        }
 
-                                if (!TryEnsureGlobalGroupMembershipWithRetry(domainContext, parentTraverseGroup, currentSecGroup))
-                                    continue;
-                            }
-                            traverseGroup = parentTraverseGroup;
-                            traverseGroupName = displayTraverseGroupName;
-                            processedNearestTraverseParent = true;
-                        }
-                        else
+                        if (!string.IsNullOrWhiteSpace(traverseGroupName))
                         {
-                            if (!string.IsNullOrWhiteSpace(traverseGroupName))
+                            try
                             {
-                                try
+                                if (IsSameGroupName(displayTraverseGroupName, traverseGroupName))
                                 {
-                                    if (IsSameGroupName(displayTraverseGroupName, traverseGroupName))
-                                    {
-                                        DefaultLogger.LogEntry(LogLevels.Debug, $"Skip nested self membership for Traverse-Gruppe '{displayTraverseGroupName}'.");
-                                    }
-                                    else if (WhatIf)
-                                    {
-                                        resultToken.warnings.Add($"Traverse-Gruppe '{displayTraverseGroupName}' würde verschachtelte Gruppe '{traverseGroupName}' erhalten.");
-                                    }
-                                    else if (traverseGroup != null && parentTraverseGroup != null && !parentTraverseGroup.Members.Contains(traverseGroup))
-                                    {
-                                        if (!TryEnsureNestedTraverseGroupMembershipWithRetry(parentTraverseGroup, traverseGroup))
-                                            continue;
-                                    }
+                                    DefaultLogger.LogEntry(LogLevels.Debug, $"Skip nested self membership for Traverse-Gruppe '{displayTraverseGroupName}'.");
                                 }
-                                catch (Exception ex)
+                                else if (WhatIf)
                                 {
-                                    DefaultLogger.LogEntry(LogLevels.Error, $"Fehler beim Hinzufügen der Traverse-Gruppe: {ex.Message}");
-                                    continue;
+                                    resultToken.warnings.Add($"Traverse-Gruppe '{displayTraverseGroupName}' würde verschachtelte Gruppe '{traverseGroupName}' erhalten.");
+                                }
+                                else if (traverseGroup != null && parentTraverseGroup != null && !parentTraverseGroup.Members.Contains(traverseGroup))
+                                {
+                                    if (!TryEnsureNestedTraverseGroupMembershipWithRetry(parentTraverseGroup, traverseGroup))
+                                        continue;
                                 }
                             }
+                            catch (Exception ex)
+                            {
+                                DefaultLogger.LogEntry(LogLevels.Error, $"Fehler beim Hinzufügen der Traverse-Gruppe: {ex.Message}");
+                                continue;
+                            }
                         }
+
+                        traverseGroup = parentTraverseGroup;
+                        traverseGroupName = displayTraverseGroupName;
                         try
                         {
                             if (!WhatIf && parentTraverseGroup != null)