Give Site Administrator permission to manage users

Permission of related endpoints changed from cmf.ManagePortal to
plone.app.controlpanel.UsersAndGroups. It was also necessary to give
Manage users and plone.restapi: Access Plone user information
permissions to the Site Administrator.

news/1704.feature

@@ -0,0 +1 @@
+Give Site Administrator permission to manage users. @wesleybl

src/plone/restapi/profiles/default/rolemap.xml

@@ -9,6 +9,11 @@
     </permission>
     <permission name="plone.restapi: Access Plone user information" acquire="True">
       <role name="Manager"/>
+      <role name="Site Administrator"/>
+    </permission>
+    <permission name="Manage users" acquire="True">
+      <role name="Manager"/>
+      <role name="Site Administrator"/>
     </permission>
   </permissions>
 </rolemap>

src/plone/restapi/services/groups/configure.zcml

@@ -8,31 +8,31 @@
       method="GET"
       factory=".get.GroupsGet"
       for="Products.CMFCore.interfaces.ISiteRoot"
-      permission="cmf.ManagePortal"
+      permission="plone.app.controlpanel.UsersAndGroups"
       name="@groups"
       />
 
   <plone:service
       method="PATCH"
       factory=".update.GroupsPatch"
       for="Products.CMFCore.interfaces.ISiteRoot"
-      permission="cmf.ManagePortal"
+      permission="plone.app.controlpanel.UsersAndGroups"
       name="@groups"
       />
 
   <plone:service
       method="POST"
       factory=".add.GroupsPost"
       for="Products.CMFCore.interfaces.ISiteRoot"
-      permission="cmf.ManagePortal"
+      permission="plone.app.controlpanel.UsersAndGroups"
       name="@groups"
       />
 
   <plone:service
       method="DELETE"
       factory=".delete.GroupsDelete"
       for="Products.CMFCore.interfaces.ISiteRoot"
-      permission="cmf.ManagePortal"
+      permission="plone.app.controlpanel.UsersAndGroups"
       name="@groups"
       />
 

src/plone/restapi/services/roles/configure.zcml

@@ -7,7 +7,7 @@
       method="GET"
       factory=".get.RolesGet"
       for="Products.CMFPlone.interfaces.IPloneSiteRoot"
-      permission="cmf.ManagePortal"
+      permission="plone.app.controlpanel.UsersAndGroups"
       name="@roles"
       />
 

src/plone/restapi/services/users/add.py

@@ -244,7 +244,7 @@ def _error(self, status, _type, msgid):
     @property
     def can_manage_users(self):
         sm = getSecurityManager()
-        return sm.checkPermission("plone.app.controlpanel.UsersAndGroups", self.context)
+        return sm.checkPermission("Plone Site Setup: Users and Groups", self.context)
 
     @property
     def can_set_own_password(self):

src/plone/restapi/services/users/configure.zcml

@@ -32,7 +32,7 @@
       method="DELETE"
       factory=".delete.UsersDelete"
       for="Products.CMFCore.interfaces.ISiteRoot"
-      permission="cmf.ManagePortal"
+      permission="plone.app.controlpanel.UsersAndGroups"
       name="@users"
       />
 

src/plone/restapi/services/users/get.py

@@ -153,11 +153,11 @@ def _get_filtered_users(self, query, groups_filter, search_term, limit):
 
     def has_permission_to_query(self):
         sm = getSecurityManager()
-        return sm.checkPermission("Manage portal", self.context)
+        return sm.checkPermission("Plone Site Setup: Users and Groups", self.context)
 
     def has_permission_to_enumerate(self):
         sm = getSecurityManager()
-        return sm.checkPermission("Manage portal", self.context)
+        return sm.checkPermission("Plone Site Setup: Users and Groups", self.context)
 
     def has_permission_to_access_user_info(self):
         sm = getSecurityManager()

src/plone/restapi/services/users/update.py

@@ -130,7 +130,7 @@ def reply(self):
     @property
     def can_manage_users(self):
         sm = getSecurityManager()
-        return sm.checkPermission("plone.app.controlpanel.UsersAndGroups", self.context)
+        return sm.checkPermission("Plone Site Setup: Users and Groups", self.context)
 
     @property
     def can_set_own_password(self):