allow moderators to view role

graph/resolvers/user.js

@@ -4,7 +4,7 @@ const {
   SEARCH_ACTIONS,
   SEARCH_OTHER_USERS,
   SEARCH_OTHERS_COMMENTS,
-  UPDATE_USER_ROLES,
+  VIEW_USER_ROLE,
   LIST_OWN_TOKENS,
   VIEW_USER_STATUS,
 } = require('../../perms/constants');
@@ -68,7 +68,7 @@ const User = {
   role({id, role}, _, {user}) {
 
     // If the user is not an admin, only return the current user's roles.
-    if (user && (user.can(UPDATE_USER_ROLES) || user.id === id)) {
+    if (user && (user.can(VIEW_USER_ROLE) || user.id === id)) {
       return role;
     }
 

perms/constants/query.js

@@ -8,4 +8,5 @@ module.exports = {
   VIEW_USER_STATUS: 'VIEW_USER_STATUS',
   VIEW_PROTECTED_SETTINGS: 'VIEW_PROTECTED_SETTINGS',
   LIST_OWN_TOKENS: 'LIST_OWN_TOKENS',
+  VIEW_USER_ROLE: 'VIEW_USER_ROLE',
 };

perms/reducers/query.js

@@ -12,6 +12,7 @@ module.exports = (user, perm) => {
   case types.SEARCH_COMMENT_STATUS_HISTORY:
   case types.VIEW_USER_STATUS:
   case types.VIEW_PROTECTED_SETTINGS:
+  case types.VIEW_USER_ROLE:
     return check(user, ['ADMIN', 'MODERATOR']);
   case types.LIST_OWN_TOKENS:
     return check(user, ['ADMIN']);