GRN2-176: Create a role editor that allows admins to specify what permissions each role has (#709)

* Add roles editor

* Add colour selection ability to roles

* Add ability to assign roles to users in the UI

* Remove rolify and replace it with our own custom roles implemenation

* - Fix all existing roles functionality
- Fix super admins

* Fix bugs with new customers not have default roles

* Add can't create room setting

* Code improvements

* Fix migration

* Add tests for new methods

* Translate reserved role names

* Pull roles from saml/ldap

* Fix rspec

* Fix scrutinizer issues

* Fix email promoted/demoted tests

* Apply comments

* Redirect directly to the main room

* Add comments

spec/controllers/users_controller_spec.rb

@@ -333,6 +333,95 @@ describe UsersController, type: :controller do
       patch :update, params: invalid_params.merge!(user_uid: @user)
       expect(response).to render_template(:edit)
     end
+
+    context 'Roles updates' do
+      it "should fail to update roles if users tries to add a role with a higher priority than their own" do
+        user = create(:user)
+        @request.session[:user_id] = user.id
+
+        user_role = user.highest_priority_role
+
+        user_role.can_edit_roles = true
+
+        user_role.save!
+
+        tmp_role = Role.create(name: "test", priority: -2, provider: "greenlight")
+
+        params = random_valid_user_params
+        patch :update, params: params.merge!(user_uid: user, user: { role_ids: tmp_role.id.to_s })
+
+        expect(flash[:alert]).to eq(I18n.t("administrator.roles.invalid_assignment"))
+        expect(response).to render_template(:edit)
+      end
+
+      it "should fail to update roles if a user tries to remove a role with a higher priority than their own" do
+        user = create(:user)
+        admin = create(:user)
+
+        admin.add_role :admin
+
+        @request.session[:user_id] = user.id
+
+        user_role = user.highest_priority_role
+
+        user_role.can_edit_roles = true
+
+        user_role.save!
+
+        params = random_valid_user_params
+        patch :update, params: params.merge!(user_uid: admin, user: { role_ids: "" })
+
+        user.reload
+
+        expect(flash[:alert]).to eq(I18n.t("administrator.roles.invalid_removal"))
+        expect(response).to render_template(:edit)
+      end
+
+      it "should successfuly add roles to the user" do
+        allow(Rails.configuration).to receive(:enable_email_verification).and_return(true)
+
+        user = create(:user)
+        admin = create(:user)
+
+        admin.add_role :admin
+
+        @request.session[:user_id] = admin.id
+
+        tmp_role1 = Role.create(name: "test1", priority: 1, provider: "greenlight", send_promoted_email: true)
+        tmp_role2 = Role.create(name: "test2", priority: 2, provider: "greenlight")
+
+        params = random_valid_user_params
+        params = params.merge!(user_uid: user, user: { role_ids: "#{tmp_role1.id} #{tmp_role2.id}" })
+
+        expect { patch :update, params: params }.to change { ActionMailer::Base.deliveries.count }.by(1)
+        expect(user.roles.count).to eq(2)
+        expect(user.highest_priority_role.name).to eq("test1")
+        expect(response).to redirect_to(admins_path)
+      end
+
+      it "all users must at least have the user role" do
+        allow(Rails.configuration).to receive(:enable_email_verification).and_return(true)
+
+        user = create(:user)
+        admin = create(:user)
+
+        admin.add_role :admin
+
+        tmp_role1 = Role.create(name: "test1", priority: 1, provider: "greenlight", send_demoted_email: true)
+        user.roles << tmp_role1
+        user.save!
+
+        @request.session[:user_id] = admin.id
+
+        params = random_valid_user_params
+        params = params.merge!(user_uid: user, user: { role_ids: "" })
+
+        expect { patch :update, params: params }.to change { ActionMailer::Base.deliveries.count }.by(1)
+        expect(user.roles.count).to eq(1)
+        expect(user.highest_priority_role.name).to eq("user")
+        expect(response).to redirect_to(admins_path)
+      end
+    end
   end
 
   describe "DELETE #user" do