[QA] unprivileged users can promote themselves to admin

[jnweiger]

Setup via docker-compose-eos-test.yml at branch fix-yml-for-rc5 on localhost

• eos space set default on for [QA] eos fst are offline by default - upload fails #862
• Login user marie
• Click the 9 dots menu, select accounts.
• Note that marie is Role User.
• Try '+Create new account' -> it fails. Good.
• Switch Role from User to Admin.
  
• Try '+Create new account' again.

Oops.

Expected behavior: normal user cannot.

[kulmann]

We recently introduced a SelfManagement permission to the Userrole. As a result the accounts UI shows the logged in user. This made it possible here, to uncover that we in fact don't have any permission checks for assigning/unassigning roles. Needs to be implemented ASAP. Might make sense to move the role assignments to the account service in the same PR.

[exalate-issue-sync]

David Christofas commented: I just looked into this and it seems like the permission checks in the settings service are missing in general.
For me it wasn't clear how to implement them so I unassigned myself until I can pair on this with someone who knows.

[exalate-issue-sync]

David Christofas commented: I found a way.

[C0rby]

@kulmann, what is the reason for moving the role assignments to the accounts service?
I understand that right now the accounts UI is depending on the settings service but when we move the assignments to the accounts service then the accounts backend will still depend on the settings service.

[kulmann]

@C0rby

1. it would save us a request in the account_resolve middleware in the proxy, because we could return the role assignments directly from the account service instead of having to make a second request to the settings services.
2. when creating users we assign a role. that could happen in the same service then, so it reduces latency.

[C0rby]

Ah you mean we would even move the store to the accounts service?

[jnweiger]

Confirmed fixed in rc6

einstein can still change his role to admin in the web UI, but it has no effect. On a reload his role is shown as 'user' again. OK.