There is a important cache issue on the first cache of RightManager (cache for the root contexts)

See org.ametys.plugins.core.impl.right.AbstractProfileStorageBasedAccessController._hasUserAnyPermissionOnWorkspace(Set<Object>, UserIdentity, Set<GroupIdentity>, Set<String>)

To fill the first cache, we call _profileAssignmentStorageEP.hasUserAnyPermission with a set of profile's ids. The profiles correspond to all profiles which contains the required right.

This method returns true as soon as one profile matches.

Then the cache is filled, BUT if the method returns true, the cache is filled with true for all profile of the set (big mistake).

Here, to fill correctly the cache, we need to get the set of allowed profiles for theses rootContexts among the set of given profiles.

In ProfileAssignmentStorage the methods
boolean hasXXXAllowedProfile(Set< ? extends Object> rootContexts, Set<String> profileIds)
should be replaced by
Set<String> getXXXAllowedProfiles(Set< ? extends Object> rootContexts, Set<String> profileIds)