user permissions: changeRole has no effect

[jaro-io]

hey there lovely kirby team 🌻
i am struggling with two things related to user permissions. i don’t know if they are related.
this is the other issue. feel free to merge if needed.

description

i would like to control what roles users with a certain role are allowed to change. for example a manager should be able to change roles for other users. but an assistant shouldn’t be able to do that. when i set the changeRole permissions to true or false in my user blueprints it doesn’t seem to have any effect.

also it seems like there is a difference between this doc and this doc. in the first one it seems like changeRole is only available for user, not users. in the second one it seems like it’s available for both.

to reproduce

start with a clean starterkit. add a new user blueprint with the following permissions.

permissions:
    user:
        delete: false # works, this user can’t delete itself
        changeRole: true # doesn’t work, this user can’t change its role
    users:
        changeRole: true # doesn’t work, this user can’t change other user’s roles

your setup

kirby 3.9.3

thank you for your help!
🤍 ✨

[afbora]

I've wrote a comment about that #5147 (comment)