feat(putUser): take roles in account

Closes #114

Roles can now be modified via putUser by passing ops.roles.

Author: ptitjes

src/index.js

@@ -44,6 +44,10 @@ function putUser(db, user, opts, callback) {
     user = assign(user, opts.metadata);
   }
 
+  if (opts.roles) {
+    user = assign(user, {roles: opts.roles});
+  }
+
   var url = getUsersUrl(db) + '/' + encodeURIComponent(user._id);
   var ajaxOpts = assign({
     method : 'PUT',
@@ -80,7 +84,7 @@ plugin.# = toPromise(function (username, password, opts, callback) {
   var user = {
     name     : username,
     password : password,
-    roles    : opts.roles || [],
+    roles    : [],
     type     : 'user',
     _id      : userId
   };

test/test.js

@@ -208,6 +208,50 @@ testCases.forEach(function (testCase) {
       });
     });
 
+    it('Test that admin can change roles', function () {
+      var roles = ['sidekick'];
+      var newRoles = ['superhero', 'villain'];
+      return db.#('robin', 'dickgrayson', {roles: roles}).then(function (res) {
+        res.ok.should.equal(true);
+        return db.getUser('robin');
+      }).then(function (user) {
+        user.roles.should.deep.equal(roles);
+      }).then(function () {
+        return db.putUser('robin', {roles: newRoles});
+      }).then(function (res) {
+        res.ok.should.equal(true);
+        return db.getUser('robin');
+      }).then(function (user) {
+        user.roles.should.deep.equal(newRoles);
+      }).catch(function (err) {
+        should.not.exist(err);
+      });
+    });
+
+    it('Test that user cannot change roles', function () {
+      var roles = ['sidekick'];
+      var newRoles = ['superhero', 'villain'];
+      // We can't test for initial roles as we are in admin party
+      // Let us have faith in CouchDB
+      return db.#('robin', 'dickgrayson', {roles: roles}).then(function (res) {
+        res.ok.should.equal(true);
+        return db.login('robin', 'dickgrayson');
+      }).then(function () {
+        return db.getUser('robin');
+      }).then(function (user) {
+        user.roles.should.deep.equal(roles);
+      }).then(function () {
+        return db.putUser('robin', {roles: newRoles});
+      }).then(function (res) {
+        res.ok.should.not.equal(true);
+        return db.getUser('robin').then(function (user) {
+          user.roles.should.deep.equal(roles);
+        });
+      }).catch(function (err) {
+        should.exist(err);
+      });
+    });
+
     it('Test wrong user for getUser', function () {
       return db.#('robin', 'dickgrayson').then(function (res) {
         return db.#('aquaman', 'sleeps_with_fishes');