Problems removing element @ManyToMany with @JoinTable

First of all I believe that your mapping can be simplified, especially the join table.

To centralize the primary key mapping of entities, I created a BaseEntity , like this:

@MappedSuperclass
public abstract class BaseEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

}

The Usuario entity looks like this:

@Entity
@Table(name = "tb_usuario")
public class Usuario extends BaseEntity {

    @Column(name = "no_usuario", unique = true, nullable = false, length = 50)
    private String nome;

    @ManyToMany(cascade = {CascadeType.PERSIST, CascadeType.MERGE}) 
    @JoinTable(name = "tb_usuario_permissao", joinColumns = {
                @JoinColumn(name = "id_usuario", nullable = false)
            }, inverseJoinColumns = {
                @JoinColumn(name = "id_permissao", referencedColumnName = "id", nullable = false)
            }
    )
    private Set<Permissao> permissoes;

}

Here we point out the following:

• Do not mix business logic with your data model, so do not use the user name as the primary key, consider it a unique key, and have
• inclusion of cascade: I do not know if you will need this, only include not to persist each permission separately. For more details on the behavior of each type see the JPA specification a>
• Since we have a primary key in tb_permissao it does not make sense to have two join columns that refer to business columns. Usually there is more than one merge column when it is a foreign key to another table, for example.

The entity Permissao , looks like this:

@Entity
@Table(name = "tb_permissao")
public class Permissao extends BaseEntity {

    @Column(name = "no_permissao", unique = true, nullable = false, length = 50)
    private String nome;

    @Column(name = "no_metodo", unique = true, nullable = false, length = 50)
    private String metodo;

}

Unless you really need to know all users have a certain permission do not need to map, even in this case I would prefer to make a query.

Now, the removal part, let's look at this excerpt:

usuario.getPermissoes().remove(0);

Well, with this model above the removal occurred as desired, logically when there are one or more permissions.

As an example (I'm using lombok ), the insertion test looks like this:

final Permissao permissao1 = Permissao.builder().nome("permissao1").metodo("metodo1").build();
em.persist(permissao1);

final Permissao permissao2 = Permissao.builder().nome("permissao2").metodo("metodo2").build();
em.persist(permissao2);

final Usuario usuario = Usuario.builder().nome("Bruno").permissao(permissao1).permissao(permissao2).build();
em.persist(usuario);

And so:

final Permissao permissao3 = Permissao.builder().nome("permissao3").metodo("metodo3").build();
final Permissao permissao4 = Permissao.builder().nome("permissao4").metodo("metodo4").build();

final Usuario usuario = Usuario.builder().nome("César").permissao(permissao3).permissao(permissao4).build();
em.persist(usuario);

Removal like this:

final Usuario usuario = em.find(Usuario.class, 1L);
usuario.getPermissoes().remove(0);
em.merge(usuario);

And adding a new permission to an existing user like this:

final Permissao permissao = em.find(Permissao.class, 1L);
final Usuario usuario = em.find(Usuario.class, 1L);
usuario.getPermissoes().add(permissao);
em.merge(usuario);

And of a still non-existent like this:

final Permissao permissao5 = Permissao.builder().nome("permissao5").metodo("metodo5").build();
final Usuario usuario = em.find(Usuario.class, 1L);
usuario.getPermissoes().add(permissao5);
em.merge(usuario);

As you did not enter further details in your question, if you do not solve your problem, please let me know more details, such as your PermissaoPK (to see if you really need it).

Assuming you get the id of the user and permission you want to be removed, delete can be done manually through a query.

Ex:

entityManager.createQuery("DELETE FROM USUARIO_PERMISSAO up WHERE up.usuarioId = :usuarioId AND up.permissaoId = :permissaoId");

  

Because using remove(index) as you are trying to use, even   which was partially functioning, the order of the List<T>   to receive values referring to that user , may end up not   being the desired permission thus having inconsistency when deleting.

In the above solution, the change occurs only in the table that maintains the relationships , having the ids , makes explicit what you want to remove .