feat: Users API, ownership transfer and removal of the legacy role string

test/roles_api_hardening_test.go

@@ -21,7 +21,7 @@ func TestRoleRepositoryRolesAPIHardening(t *testing.T) {
 		db := openMigratedRolesDB(t)
 		repo := persistence.NewRoleRepository(db)
 		source := rolesAPICreateRole(t, repo, "Contributor", "content.read=all")
-		createUserRow(t, db, 1, "", &source.ID)
+		createUserRow(t, db, 1, &source.ID)
 		moved, err := repo.ReassignMembers(source.ID, 9999)
 		if !errors.Is(err, role.ErrInvalidReassign) || moved != 0 {
 			t.Fatalf("expected ErrInvalidReassign, got %d %v", moved, err)
@@ -81,7 +81,7 @@ func TestRoleRepositoryRolesAPIHardening(t *testing.T) {
 		repo := persistence.NewRoleRepository(db)
 		kept := rolesAPICreateRole(t, repo, "Contributor", "content.read=all")
 		gone := rolesAPICreateRole(t, repo, "Intern", "content.read=own")
-		createUserRow(t, db, 1, "", &kept.ID)
+		createUserRow(t, db, 1, &kept.ID)
 		if err := repo.Delete(kept.ID); !errors.Is(err, role.ErrRoleHasMembers) {
 			t.Fatalf("expected ErrRoleHasMembers, got %v", err)
 		}
@@ -165,7 +165,7 @@ func TestRolesAPIHardeningUseCases(t *testing.T) {
 
 	t.Run("a member count failure while deleting a role is reported and deletes nothing", func(t *testing.T) {
 		world := newRolesAPIWorld(t)
-		world.roles.fail.failNext("GetByName")
+		world.roles.fail.failNext("MemberCounts")
 		err := world.remove(raAdmin, "Intern")
 		if !errors.Is(err, errRepositoryFailure) {
 			t.Fatalf("expected the repository failure, got %v", err)