feat: roles SPA Users, Profile, API keys, Activity

test/users_api_http_test.go

@@ -170,7 +170,7 @@ func TestUsersAPIChangeRoleHTTP(t *testing.T) {
 				if rec.Code != 200 || item["kind"] != "user" || item["status"] != "accepted" {
 					t.Fatalf("unexpected %d %q", rec.Code, rec.Body.String())
 				}
-				apiKeyAssertExactFields(t, item, "id", "kind", "username", "display_name", "email", "role", "status", "created_at")
+				apiKeyAssertExactFields(t, item, "id", "kind", "username", "display_name", "email", "role", "role_assigned_by", "status", "created_at")
 				if ref := usersAPIRoleRef(t, item); ref["name"] != row.role || ref["id"] != float64(w.ids[row.role]) {
 					t.Errorf("unexpected role %v", ref)
 				}
@@ -341,6 +341,9 @@ func TestUsersAPIInviteHTTP(t *testing.T) {
 			default:
 				assertRefusal(t, rec, row.status, row.code)
 			}
+			if got := rec.Header().Get(apperr.ErrorCodeHeader); got != inviteConflictCodes[row.code] {
+				t.Errorf("%s = %q, expected %q", apperr.ErrorCodeHeader, got, inviteConflictCodes[row.code])
+			}
 			if len(w.mail.SentEmails) != 0 || len(w.invites.invites) != 4 {
 				t.Errorf("a refusal creates no invite and sends no mail")
 			}
@@ -565,7 +568,7 @@ func TestUsersAPIListHTTP(t *testing.T) {
 			seen[key] = true
 			switch kind {
 			case "user":
-				apiKeyAssertExactFields(t, item, "id", "kind", "username", "display_name", "email", "role", "status", "created_at")
+				apiKeyAssertExactFields(t, item, "id", "kind", "username", "display_name", "email", "role", "role_assigned_by", "status", "created_at")
 			default:
 				apiKeyAssertExactFields(t, item, "id", "kind", "email", "role", "status", "created_at")
 			}
@@ -636,3 +639,8 @@ func TestUsersAPIPublicUserShape(t *testing.T) {
 		}
 	})
 }
+
+var inviteConflictCodes = map[string]string{
+	apperr.PendingInviteErrorMessage:   "invite_pending",
+	apperr.EmailHasAccountErrorMessage: "email_has_account",
+}