changed the order of index creation during restore for _users collection

arangosh/Restore/RestoreFeature.cpp

@@ -1060,27 +1060,46 @@ arangodb::Result processInputDirectory(
 arangodb::Result processJob(arangodb::httpclient::SimpleHttpClient& httpClient,
                             arangodb::RestoreFeature::JobData& jobData) {
   arangodb::Result result;
-  if (jobData.options.indexesFirst && jobData.options.importStructure) {
-    // restore indexes first if we are using rocksdb
+
+  VPackSlice const parameters = jobData.collection.get("parameters");
+  std::string const cname =
+      arangodb::basics::VelocyPackHelper::getStringValue(parameters, "name", "");
+
+  if (cname == "_users") {
+    // special case: never restore data in the _users collection first as it could
+    // potentially change user permissions. In that case index creation will fail.
     result = ::restoreIndexes(httpClient, jobData);
     if (result.fail()) {
       return result;
     }
-  }
-  if (jobData.options.importData) {
     result = ::restoreData(httpClient, jobData);
     if (result.fail()) {
       return result;
     }
-  }
-  if (!jobData.options.indexesFirst && jobData.options.importStructure) {
-    // restore indexes second if we are using mmfiles
-    result = ::restoreIndexes(httpClient, jobData);
-    if (result.fail()) {
-      return result;
+  } else {
+    if (jobData.options.indexesFirst && jobData.options.importStructure) {
+      // restore indexes first if we are using rocksdb
+      result = ::restoreIndexes(httpClient, jobData);
+      if (result.fail()) {
+        return result;
+      }
+    }
+    if (jobData.options.importData) {
+      result = ::restoreData(httpClient, jobData);
+      if (result.fail()) {
+        return result;
+      }
+    }
+    if (!jobData.options.indexesFirst && jobData.options.importStructure) {
+      // restore indexes second if we are using mmfiles
+      result = ::restoreIndexes(httpClient, jobData);
+      if (result.fail()) {
+        return result;
+      }
     }
   }
 
+
   ++jobData.stats.restoredCollections;
 
   if (jobData.options.progress) {