Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Give Site Administrator permission to manage users (#1712)
* Give Site Administrator permission to manage users Permission of related endpoints changed from cmf.ManagePortal to plone.app.controlpanel.UsersAndGroups. It was also necessary to give Manage users and plone.restapi: Access Plone user information permissions to the Site Administrator. * Does not allow a Site Administrator to set a Manager role * Does not allow a Site Administrator delete Manager * Test that the Site Administrator cannot add a Manager * Do not allow a Site Administrator user to add users to groups that have the Manager role * Do not allow the Site Administrator to set the Manager role for a group * Do not allow the Site Administrator to create groups with the Manager role * Does not allow an Site Administrator add group to group with Manager role * Do not allow Site Administrator to delete group with Manager role * Add can_assign and can_assign_add keys to the roles endpoint This is to inform the front-end whether role assignment should be allowed or not. It was necessary to create the can_assign_add key, because a user can only create another with the roles they have. But in editing he can assign other roles. * Add can_delete key to the users endpoint Used to backend hide remove user button if user cannot be removed by currently authenticated user * Add can_delete key to the groups endpoint Used to backend hide remove group button if group cannot be removed by currently authenticated user * Does not allow a Site Administrator to change a Manager's email and password * Update examples in documentation * Uses acl_users.userFolderDelUsers to delete users Therefore, it is not necessary to give Manage users permission to the Site Administrator. * Simplifies logic that defines whether the user can update roles * Show message on lack of permission errors * Set default roles as list This prevents '"Manager" in roles' breaking if roles was missing * Quote the plone.app.controlpanel.UsersAndGroups permission in changes * Remove can_assign_add key * Add upgrade step Upgrade step to give permission plone.restapi: Access Plone user information to Site Administrator * Define can_delete in group serializer * Define can_delete in users serializer * Shows the can_delete key in the users and groups serializer only if the user has "Plone Site Setup: Users and Groups" permission * Rename ManageUsers to PloneManageUsers * Uses PloneManageUsers variable instead of the string * Remove can_delete key from users/groups endpoints * Remove can_assign key from roles endpoint * remove unused function --------- Co-authored-by: David Glick <david@glicksoftware.com>
- Loading branch information
