feat: Users API, ownership transfer and removal of the legacy role string

test/roles_permissions_enforcement_test.go

@@ -93,10 +93,8 @@ func TestCheckPermissionUseCase(t *testing.T) {
 	t.Run("An unresolvable role is refused as a missing permission", func(t *testing.T) {
 		check, _ := newCheck()
 		for name, account := range map[string]user.User{
-			"unknown role_id":         {ID: 13, RoleID: 99},
-			"empty legacy and no id":  {ID: 14, Role: ""},
-			"editor legacy and no id": {ID: 15, Role: "editor"},
-			"legacy owner string ignored when role_id names Writer": {ID: 16, Role: user.RoleOwner, RoleID: writerRoleID},
+			"unknown role_id": {ID: 13, RoleID: 99},
+			"role id zero":    {ID: 14},
 		} {
 			_, err := check.Require(account, "users.invite")
 			if !errors.Is(err, role.ErrMissingPermission) || missingKeyOf(t, err) != "users.invite" {
@@ -107,10 +105,10 @@ func TestCheckPermissionUseCase(t *testing.T) {
 
 	t.Run("The legacy string resolves only owner and admin when there is no role_id", func(t *testing.T) {
 		check, _ := newCheck()
-		if _, err := check.Require(user.User{ID: 17, Role: user.RoleOwner}, "system.apply_updates"); err != nil {
+		if _, err := check.Require(user.User{ID: 17, RoleID: ownerRoleID}, "system.apply_updates"); err != nil {
 			t.Errorf("legacy owner: %v", err)
 		}
-		if _, err := check.Require(user.User{ID: 18, Role: user.RoleAdmin}, "system.apply_updates"); !errors.Is(err, role.ErrMissingPermission) {
+		if _, err := check.Require(user.User{ID: 18, RoleID: adminRoleID}, "system.apply_updates"); !errors.Is(err, role.ErrMissingPermission) {
 			t.Errorf("legacy admin should lack owner-only keys, got %v", err)
 		}
 	})