finish implied permissions

pkg/controller/user/update_test.go

@@ -63,9 +63,14 @@ func TestUpdate(t *testing.T) {
 
 	for _, permission := range rbac.NamePermissionMap {
 		permission := permission
-		target := fmt.Sprintf(`input#permission-%d`, permission)
+		targets := []string{fmt.Sprintf(`input#permission-%d`, permission)}
+		// We also ned to remove permissions that imply this permission, or it will be added back in.
+		for _, superPerm := range rbac.ImpliedBy(permission) {
+			targets = append(targets, fmt.Sprintf(`input#permission-%d`, superPerm))
+		}
 
-		if err := chromedp.Run(taskCtx,
+		// Build the actions as an array prior to run since super-permissions actions aren't known until runtime.
+		actions := []chromedp.Action{
 			// Pre-authenticate the user.
 			browser.SetCookie(cookie),
 
@@ -74,14 +79,18 @@ func TestUpdate(t *testing.T) {
 
 			// Wait for render.
 			chromedp.WaitVisible(`body#users-edit`, chromedp.ByQuery),
+		}
 
-			// Fill out the form.
-			chromedp.RemoveAttribute(target, "checked", chromedp.ByQuery),
-			chromedp.Submit(`form#user-form`, chromedp.ByQuery),
+		// Fill out the form.
+		for _, target := range targets {
+			actions = append(actions, chromedp.RemoveAttribute(target, "checked", chromedp.ByQuery))
+		}
+		actions = append(actions, chromedp.Submit(`form#user-form`, chromedp.ByQuery))
 
-			// Wait for render.
-			chromedp.WaitVisible(`body#users-show`, chromedp.ByQuery),
-		); err != nil {
+		// Wait for render.
+		actions = append(actions, chromedp.WaitVisible(`body#users-show`, chromedp.ByQuery))
+
+		if err := chromedp.Run(taskCtx, actions...); err != nil {
 			t.Fatal(err)
 		}
 	}

pkg/rbac/rbac.go

@@ -83,6 +83,11 @@ func CompileAndAuthorize(actorPermission Permission, toUpdate []Permission) (Per
 	return permission, nil
 }
 
+// ImpliedBy returns any permissions that
+func ImpliedBy(permission Permission) []Permission {
+	return impliedBy[permission]
+}
+
 // PermissionNames returns the list of permissions included in the given
 // permission.
 func PermissionNames(p Permission) []string {
@@ -166,8 +171,23 @@ var (
 		MobileAppWrite: {MobileAppRead},
 		UserWrite:      {UserRead},
 	}
+
+	// This is the inverse of the above map, set by the init() func.
+	// Done in code to ensure it always stays in sync with requiredPermission.
+	impliedBy = make(map[Permission][]Permission)
 )
 
+func init() {
+	for has, needs := range requiredPermission {
+		for _, perm := range needs {
+			if _, ok := impliedBy[perm]; !ok {
+				impliedBy[perm] = make([]Permission, 0, 1)
+			}
+			impliedBy[perm] = append(impliedBy[perm], has)
+		}
+	}
+}
+
 // --
 // Legacy permissions
 // --