feat: more role backend and admin/writer roles additions and adjustments

test/activity_next_cleanup_test.go

@@ -106,7 +106,7 @@ func TestSettingsNextCleanupHttp(t *testing.T) {
 		e.settings.settings.LastCleanupAt = activityPtr(time.Date(2026, time.October, 6, 1, 0, 0, 0, time.UTC))
 		e.settings.settings.LastCleanupRemoved = 142
 
-		rec := e.get("/v1/settings", asUser(e, activityEditorID))
+		rec := e.get("/v1/settings", asUser(e, activityAdminID))
 
 		body := keys(t, rec.Body.String())
 		if rec.Code != http.StatusOK || len(body) != 7 || body["activity_next_cleanup_at"] != "2026-10-07T03:00:00Z" || body["activity_last_cleanup_removed"] != float64(142) {
@@ -179,13 +179,14 @@ func TestSettingsNextCleanupQAFlow(t *testing.T) {
 		}
 	})
 
-	t.Run("GET is open to owner, admin and editor and refused without a cookie", func(t *testing.T) {
+	t.Run("GET is open to owner and admin and refused to an editor and without a cookie", func(t *testing.T) {
 		e := newActivityHTTPEnv(t, 1000)
-		for _, id := range []uint32{activityOwnerID, activityAdminID, activityEditorID} {
+		for _, id := range []uint32{activityOwnerID, activityAdminID} {
 			if rec := e.get("/v1/settings", asUser(e, id)); rec.Code != http.StatusOK {
 				t.Errorf("user %d: expected 200, got %d", id, rec.Code)
 			}
 		}
+		assertPlain(t, e.get("/v1/settings", asUser(e, activityEditorID)), http.StatusForbidden, apperr.MissingPermissionErrorMessage)
 		if rec := e.get("/v1/settings"); rec.Code != http.StatusUnauthorized {
 			t.Errorf("expected 401, got %d", rec.Code)
 		}
@@ -196,7 +197,7 @@ func TestSettingsNextCleanupQAFlow(t *testing.T) {
 
 		rec := e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 30}`, asUser(e, activityEditorID))
 
-		assertPlain(t, rec, http.StatusForbidden, apperr.OwnerRequiredErrorMessage)
+		assertPlain(t, rec, http.StatusForbidden, apperr.MissingPermissionErrorMessage)
 		if e.settings.retentionOK != 0 || len(e.all(t)) != 0 {
 			t.Error("the editor changed something")
 		}