prevent lingering permissions when unrestricting (#65)

Whenever a tag is no longer being restricted, a permission entry in
group_permission lingers around for `viewDiscussions`. This commit
removes all permissions configured after you stop restricting them.

Co-authored-by: Franz Liedke <franz@develophp.org>

extensions/tags/src/Tag.php

@@ -52,8 +52,14 @@ class Tag extends AbstractModel
     {
         parent::boot();
 
-        static::deleted(function ($tag) {
+        static::saved(function (self $tag) {
-            Permission::where('permission', 'like', "tag{$tag->id}.%")->delete();
+            if ($tag->wasUnrestricted()) {
+                $tag->deletePermissions();
+            }
+        });
+
+        static::deleted(function (self $tag) {
+            $tag->deletePermissions();
         });
     }
 
@@ -164,6 +170,24 @@ class Tag extends AbstractModel
         ]);
     }
 
+    /**
+     * Has this tag been unrestricted recently?
+     *
+     * @return bool
+     */
+    public function wasUnrestricted()
+    {
+        return ! $this->is_restricted && $this->wasChanged('is_restricted');
+    }
+
+    /**
+     * Delete all permissions belonging to this tag.
+     */
+    public function deletePermissions()
+    {
+        Permission::where('permission', 'like', "tag{$this->id}.%")->delete();
+    }
+
     protected static function getIdsWherePermission(User $user, string $permission, bool $condition = true): array
     {
         static $tags;