ListAccess: Fix incorrect behavior when group appears twice for same rule

Later versions docs [1] have been updated to say that only a single rule
is picked and that it is the first rule. That description matches the
implementation for ACL evaluation in this version, but the REST API
'/access/?project=<project>' returns the wrong value.

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#_deny

Change-Id: Ia20714cc8445b1f2d0c895fdc51ab72dc7ea0895
Bug: Issue 14963

1 files changed, 1 insertions, 1 deletions

diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/access/ListAccess.java b/gerrit-server/src/main/java/com/google/gerrit/server/access/ListAccess.java
index 580897fecc..5065a8bed5 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/access/ListAccess.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/access/ListAccess.java
@@ -273,7 +273,7 @@ public class ListAccess implements RestReadView<TopLevelResource> {
       exclusive = toBoolean(permission.getExclusiveGroup());
       rules = Maps.newHashMap();
       for (PermissionRule r : permission.getRules()) {
-        rules.put(r.getGroup().getUUID().get(), new PermissionRuleInfo(r));
+        rules.putIfAbsent(r.getGroup().getUUID().get(), new PermissionRuleInfo(r)); // First entry for the group wins
       }
     }
   }