Admin needs to be able to set roles on other users

[solebared]

• Add fields on /users/edit
• Show roles on /users
• Review pundit policy to ensure access is limited to admins+.
  • Ideally, a user is only able to set roles on users with equivalent levels of access and below.

[samudary]

I can pick this up next

[samudary]

@exbinary Could you clarify a few things please?

How does an admin role differ from a sys_admin?

Ideally, a user is only able to set roles on users with equivalent levels of access and below.

I was assuming that the admin role has the highest access level and could therefore set roles for all other users. However, this statement leads me to believe that may not be true. Also, should all roles have permission to set the role of other users or should this ability be reserved only for admins?

What is the hierarchy of roles defined by UserRole::ROLES?

[solebared]

Great questions @samudary!

The UserRole::ROLES array is ordered to represent the hierarchy of roles, from unset having least privileges to sys_admin having the most.

However, the initial set of roles was a guess at what would be needed and we haven't implemented concrete, discernible differences between some of them. For example, admin and sys_admin roles currently have the same abilities.

For an initial implementation, let's keep it simple and allow anyone with sys_admin or admin privileges to set roles on any other user. We can implement a more nuances scheme in a later release, giving us more time to surface actual needs.

[samudary]

@exbinary Thanks for the clarification! Opened a PR that's ready for review: #908