feat: more role backend and admin/writer roles additions and adjustments

test/activity_log_backend_http_test.go

@@ -41,6 +41,7 @@ const (
 type activityHTTPEnv struct {
 	*activityHarness
 	users     *mockUserRepo
+	roles     *mockRoleRepo
 	keys      *mockAPIKeyRepo
 	articles  *mockArticleRepo
 	mail      *mockMailRepo
@@ -56,6 +57,7 @@ func newActivityHTTPEnv(t *testing.T, attempts int) *activityHTTPEnv {
 	e := &activityHTTPEnv{
 		activityHarness: h,
 		users:           newMockUserRepo(),
+		roles:           newSeededMockRoleRepo(),
 		keys:            newMockAPIKeyRepo(),
 		articles:        newMockArticleRepo(),
 		mail:            newMockMailRepo(),
@@ -64,7 +66,7 @@ func newActivityHTTPEnv(t *testing.T, attempts int) *activityHTTPEnv {
 	}
 	e.users.users[activityOwnerID] = user.User{ID: activityOwnerID, Username: "marta", DisplayName: "Marta Alves", Email: "marta@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: user.RoleOwner}
 	e.users.users[activityAdminID] = user.User{ID: activityAdminID, Username: "dev", Email: "dev@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: user.RoleAdmin}
-	e.users.users[activityEditorID] = user.User{ID: activityEditorID, Username: "ed", Email: "ed@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: "editor"}
+	e.users.users[activityEditorID] = user.User{ID: activityEditorID, Username: "ed", Email: "ed@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: "editor", RoleID: writerRoleID}
 	e.users.users[activityUnverifiedID] = user.User{ID: activityUnverifiedID, Username: "quinn", Email: "quinn@example.com", IsVerified: false, Role: user.RoleOwner}
 	e.users.nextID = 4
 
@@ -73,14 +75,15 @@ func newActivityHTTPEnv(t *testing.T, attempts int) *activityHTTPEnv {
 	container := &api.UseCases{
 		Token:                          e.token,
 		GetUserUseCase:                 useCases.NewGetUserUseCase(e.users),
+		CheckPermissionUseCase:         useCases.NewCheckPermissionUseCase(e.roles),
 		GetMyAuthorUseCase:             useCases.NewGetMyAuthorUseCase(plainAuthors()),
-		GetMyAccessUseCase:             useCases.NewGetMyAccessUseCase(newSeededMockRoleRepo()),
+		GetMyAccessUseCase:             useCases.NewGetMyAccessUseCase(e.roles),
 		AuthenticateUserUseCase:        useCases.NewAuthenticateUserUseCase(e.users, hasher, h.recorder),
 		RequestPasswordResetUseCase:    useCases.NewRequestPasswordResetUseCase(e.users, hasher, e.mail, "https://cms.example.com", h.recorder),
 		ResetPasswordUseCase:           useCases.NewResetPasswordUseCase(e.users, hasher, e.keys, resetClock, h.recorder),
 		CreateAPIKeyUseCase:            useCases.NewCreateAPIKeyUseCase(e.keys, e.generator, h.clock, h.recorder),
 		ListAPIKeysUseCase:             useCases.NewListAPIKeysUseCase(e.keys, e.users, h.clock),
-		RevokeAPIKeyUseCase:            useCases.NewRevokeAPIKeyUseCase(e.keys, e.users, h.clock, h.recorder),
+		RevokeAPIKeyUseCase:            useCases.NewRevokeAPIKeyUseCase(e.keys, h.clock, h.recorder),
 		AuthenticateAPIKeyUseCase:      useCases.NewAuthenticateAPIKeyUseCase(e.keys, e.generator, e.users, h.clock),
 		GetSettingsUseCase:             useCases.NewGetSettingsUseCase("v-test"),
 		GetActivityRetentionUseCase:    useCases.NewGetActivityRetentionUseCase(h.settings, h.probe, h.clock),
@@ -277,7 +280,7 @@ func TestActivityLogBackendAudienceGates(t *testing.T) {
 	t.Run("A scoped caller cannot read the summary or the export", func(t *testing.T) {
 		for _, path := range []string{"/v1/activity/summary", "/v1/activity/export"} {
 			e := newActivityHTTPEnv(t, 1000)
-			assertPlain(t, e.get(path, asUser(e, activityEditorID)), http.StatusForbidden, apperr.OwnerOrAdminRequiredErrorMessage)
+			assertPlain(t, e.get(path, asUser(e, activityEditorID)), http.StatusForbidden, apperr.MissingPermissionErrorMessage)
 			if e.probe.reads != 0 {
 				t.Error("the audit repository was read")
 			}
@@ -670,7 +673,7 @@ func TestActivityLogBackendRetentionSetting(t *testing.T) {
 	t.Run("The default is 90 days", func(t *testing.T) {
 		e := newActivityHTTPEnv(t, 1000)
 
-		rec := e.get("/v1/settings", asUser(e, activityEditorID))
+		rec := e.get("/v1/settings", asUser(e, activityAdminID))
 
 		assertJSONEqual(t, `{"version":"v-test","activity_retention_days":90,"activity_retention_max_gb":0,"activity_log_size_bytes":0,"activity_last_cleanup_at":null,"activity_last_cleanup_removed":0,"activity_next_cleanup_at":"2026-10-07T03:00:00Z"}`, rec.Body.String())
 	})
@@ -680,7 +683,7 @@ func TestActivityLogBackendRetentionSetting(t *testing.T) {
 		e.settings.settings.LastCleanupAt = activityPtr(time.Date(2026, time.October, 6, 3, 0, 0, 0, time.UTC))
 		e.settings.settings.LastCleanupRemoved = 142
 
-		body := settingsBodyOf(e.get("/v1/settings", asUser(e, activityEditorID)))
+		body := settingsBodyOf(e.get("/v1/settings", asUser(e, activityAdminID)))
 
 		if body["activity_last_cleanup_at"] != "2026-10-06T03:00:00Z" || body["activity_last_cleanup_removed"] != float64(142) {
 			t.Errorf("unexpected body %v", body)
@@ -732,7 +735,7 @@ func TestActivityLogBackendRetentionSetting(t *testing.T) {
 
 		rec := e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 30}`, asUser(e, activityAdminID))
 
-		assertPlain(t, rec, http.StatusForbidden, apperr.OwnerRequiredErrorMessage)
+		assertPlain(t, rec, http.StatusForbidden, apperr.MissingPermissionErrorMessage)
 		if e.settings.settings.RetentionDays != 90 {
 			t.Error("the retention changed")
 		}