alphagov/whitehall — pull request #1031 by tekin (2013-11-11 12:26:25+00:00)
Title: Ensure managing editors can always unpublish

The authority rules are not currently set up to deal with resolving
permissions when a user has multiple roles. Up to now, we have got
away with this because roles have privileges base on a linear
hierarchy, with GDS editors at the top and world writers at the
bottom. This has allowed us to check the users access level by
checking which role they have, starting at the top of the hierarchy
and working down, granting them access once a matching role is found.
However, the new "Managing Editor" role breaks this hierarchy as,
although it is a less priviledged role than GDS Editor, managing
editors can unpublish editions whereas GDS Editors cannot. This means
that a linier check would prevent a user that has both the GDS Editor
and Managing Editor roles from unpublishing editions.

In lieu of rewriting the enforcer rules to check against multiple
roles, this commit ensures that a user with the "Managing Editor" role
will always be able to unpublish editions they have access to.