Hide sensitive user info from users without permission
Show change_role and get_full actions in 'allowed_methods' for User
Only change users role if we have permission to do so
Move Model_User->for_api() into a view object instead

Trying to seperate the API presentation from the model a bit. Still
feeling a little hacky though, particularly settings ACL/Current user
for the view.
Hide 'role' field on user edit form if we don't have permission
Throw a 403 when trying to change role w/o permission
Better permissions on users API, and reflect these in UI

Summary:
# Hide sensitive user info from users without permission
# Show change_role and get_full actions in 'allowed_methods' for User
# Only change users role if we have permission to do so
# Throw a 403 when trying to change role w/o permission
# Move Model_User->for_api() into a view object instead
  Trying to seperate the API presentation from the model a bit. Still
  feeling a little hacky though, particularly settings ACL/Current user
  for the view.
# Hide 'role' field on user edit form if we don't have permission
# Add a test for changing a role w/o permission

Test Plan:
- Log in to UI as admin and check that change role field appears when editing user
- Log in to UI as user, change role field should not appear when editing user
- Run API tests, see that changing role w/o permission results in 403

Reviewers: shadowhand, eyedol

Maniphest Tasks: T115

Differential Revision: https://phabricator.ushahidi.com/D11
Hide sensitive user info from users without permission

Summary:
- Hide sensitive user info from users without permission
- Show change_role and get_full actions in 'allowed_methods' for User
- Only change users role if we have permission to do so
- Throw a 403 when trying to change role w/o permission
- Move Model_User->for_api() into a view object instead Trying to seperate the API presentation from the model a bit. Still feeling a little hacky though, particularly settings ACL/Current user for the view.
- Hide 'role' field on user edit form if we don't have permission
- Add a test for changing a role w/o permission

Test Plan:
- Log in to UI as admin and check that change role field appears when editing user
- Log in to UI as user, change role field should not appear when editing user
- Run API tests, see that changing role w/o permission results in 403

Reviewers: shadowhand, eyedol

Maniphest Tasks: T115

Differential Revision: https://phabricator.ushahidi.com/D14
Add missing semicolon in View_Api class
Check user role is set before validating
Hide sensitive user info from users without permission

Summary:
- Hide sensitive user info from users without permission
- Show change_role and get_full actions in 'allowed_methods' for User
- Only change users role if we have permission to do so
- Throw a 403 when trying to change role w/o permission
- Move Model_User->for_api() into a view object instead Trying to seperate the API presentation from the model a bit. Still feeling a little hacky though, particularly settings ACL/Current user for the view.
- Hide 'role' field on user edit form if we don't have permission
- Add a test for changing a role w/o permission

Test Plan:
- Log in to UI as admin and check that change role field appears when editing user
- Log in to UI as user, change role field should not appear when editing user
- Run API tests, see that changing role w/o permission results in 403

Reviewers: shadowhand, eyedol

Reviewed By: shadowhand, eyedol

Maniphest Tasks: T115

Differential Revision: https://phabricator.ushahidi.com/D14