Merge branch 'next' into plugin-context

graph/resolvers/user.js

@@ -4,7 +4,7 @@ const {
   SEARCH_ACTIONS,
   SEARCH_OTHER_USERS,
   SEARCH_OTHERS_COMMENTS,
-  UPDATE_USER_ROLES,
+  VIEW_USER_ROLE,
   LIST_OWN_TOKENS,
   VIEW_USER_STATUS,
 } = require('../../perms/constants');
@@ -68,7 +68,7 @@ const User = {
   role({id, role}, _, {user}) {
 
     // If the user is not an admin, only return the current user's roles.
-    if (user && (user.can(UPDATE_USER_ROLES) || user.id === id)) {
+    if (user && (user.can(VIEW_USER_ROLE) || user.id === id)) {
       return role;
     }
 

perms/constants/query.js

@@ -8,4 +8,5 @@ module.exports = {
   VIEW_USER_STATUS: 'VIEW_USER_STATUS',
   VIEW_PROTECTED_SETTINGS: 'VIEW_PROTECTED_SETTINGS',
   LIST_OWN_TOKENS: 'LIST_OWN_TOKENS',
+  VIEW_USER_ROLE: 'VIEW_USER_ROLE',
 };

perms/reducers/mutation.js

@@ -22,17 +22,17 @@ module.exports = (user, perm) => {
   case types.REMOVE_COMMENT_TAG:
     return check(user, ['ADMIN', 'MODERATOR', 'STAFF']);
 
-  case types.UPDATE_USER_ROLES:
   case types.SET_COMMENT_STATUS:
   case types.SET_USER_USERNAME_STATUS:
   case types.SET_USER_BAN_STATUS:
   case types.SET_USER_SUSPENSION_STATUS:
-  case types.UPDATE_CONFIG:
-  case types.UPDATE_SETTINGS:
   case types.UPDATE_ASSET_SETTINGS:
   case types.UPDATE_ASSET_STATUS:
     return check(user, ['ADMIN', 'MODERATOR']);
 
+  case types.UPDATE_CONFIG:
+  case types.UPDATE_SETTINGS:
+  case types.UPDATE_USER_ROLES:
   case types.CREATE_TOKEN:
   case types.REVOKE_TOKEN:
     return check(user, ['ADMIN']);

perms/reducers/query.js

@@ -12,6 +12,7 @@ module.exports = (user, perm) => {
   case types.SEARCH_COMMENT_STATUS_HISTORY:
   case types.VIEW_USER_STATUS:
   case types.VIEW_PROTECTED_SETTINGS:
+  case types.VIEW_USER_ROLE:
     return check(user, ['ADMIN', 'MODERATOR']);
   case types.LIST_OWN_TOKENS:
     return check(user, ['ADMIN']);

test/server/graph/mutations/updateSettings.js

@@ -27,8 +27,8 @@ describe('graph.mutations.updateSettings', () => {
 
     [
       {error: 'NOT_AUTHORIZED', role: 'COMMENTER'},
+      {error: 'NOT_AUTHORIZED', role: 'MODERATOR'},
       {role: 'ADMIN'},
-      {role: 'MODERATOR'},
     ].forEach(({role, error}) => {
       it(`role = ${role}`, async () => {
         const user = new UserModel({role});