branch-rules forbid removal of permissions assigned.

rhodecode/model/db.py

@@ -1952,6 +1952,10 b' class Repository(Base, BaseModel):'
             # if this user is also owner/admin, mark as duplicate record
             if usr.user_id == owner_row[0].user_id or usr.user_id in super_admin_ids:
                 usr.duplicate_perm = True
+            # also check if this permission is maybe used by branch_permissions
+            if _usr.branch_perm_entry:
+                usr.branch_rules = [x.branch_rule_id for x in _usr.branch_perm_entry]
+
             usr.permission = _usr.permission.permission_name
             usr.permission_id = _usr.repo_to_perm_id
             perm_rows.append(usr)

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -74,11 +74,19 b''
                                     %if getattr(_user, 'duplicate_perm', None):
                                         (${_('inactive duplicate')})
                                     %endif
+                                    %if getattr(_user, 'branch_rules', None):
+                                        <% used_by_n_rules = len(_user.branch_rules) %>
+                                        % if used_by_n_rules == 1:
+                                            (${_('used by {} branch rule').format(used_by_n_rules)})
+                                        % else:
+                                            (${_('used by {} branch rules').format(used_by_n_rules)})
+                                        % endif
+                                    %endif
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
-                          %if _user.username != h.DEFAULT_USER:
+                          %if _user.username != h.DEFAULT_USER and getattr(_user, 'branch_rules', None) is None:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             ${_('Revoke')}