Admin with limited role edit permissions can remove any role from a user (unknowingly)

[seand7565]

Consider the following situation:

• A CX user with limited admin access, which restricts role editing to specific roles (with below permissions as an example)

        can [:read, :manage], ::Spree::Role
        cannot :manage, ::Spree::Role, name: 'admin'

• The CX user views an admin user, and only sees the roles they are allowed to manage - no admin role, because they don't have permission to manage it (restricted here)
• The CX changes a non-admin role, hits update

In the users_controller update action, we update the roles here (as part of the user update via params) and here (specifically setting the roles) - they both work the same way, replacing all the roles the user has with the ones that the admin user has selected.

But since we're replacing the roles, and the CX user didn't have access to see the admin roles, the admin user loses admin access (since the params did not include the admin role id) - and CX is none the wiser of the mistake!

This happened to me the other day and made me think I was in the process of being fired because I unexpectedly lost admin access. Please, for the sake of my heart, let's fix this! 😄

(also we should probably not update roles twice in the same action)

[waiting-for-dev]

It should be fixed on #4609. @seand7565, please, take a look. I hope that helps with your heart's health 🙂