Good catch, MA, I hadn't even thought of this!

To me, the ideal way to prevent abuse would be, where a user can only add the group and not remove it, to only allow that user to increase the expiry date. Decreasing the expiry date would require both add and remove rights. To keep things simple, users with remove rights could only remove permissions (as now), not adjust the expiry date. How does that sound?

So:

• users with add rights but not remove: allow them to just augment/increase expiry date in case the right was temporarily granted.
  • I'd say works for me. However if the right was permanently granted I'd suggest that the expiry form be hidden for them since you can't increase the duration of an indefinitely granted user right.

• users with add and remove: I'd say that those should be able to adjust permissions and even convert indef rights in temp. rights. But if the later is deemed too complicated for now, I'm fine with the "remove, re-grant temporary" strategy.

Change 335217 had a related patch set uploaded (by TTO):
Prevent circumventing restrictions on removing user groups with expiries

https://gerrit.wikimedia.org/r/335217

Change 335217 merged by jenkins-bot:
Prevent use of expiries to circumvent restrictions on removing user groups

https://gerrit.wikimedia.org/r/335217