fix(users): require the caller to hold the target's privileges on update and delete

[rudycelekli]

Problem

PatchUser and DeleteUser in backend/pkg/server/services/users.go only check for users.edit / users.delete. They never check that the caller holds every privilege of the target user's role, although CreateUser does. A custom role that has users.edit or users.delete but fewer other privileges can therefore reset the password of, block, or delete an administrator.

This needs a custom role to be reachable (only the default Admin role holds those privileges today), so it is defence-in-depth rather than an exploitable default.

Change

Add canManageUser, which applies the same privilege-subset rule CreateUser uses to the target's role and skips the check for the caller's own record. It runs in both handlers after the target is loaded and returns 403 NotPermitted.

Tests

New TestUsers_PatchAndDeleteUser_RefuseATargetWithPrivilegesTheCallerLacks covers patch and delete against an administrator (refused, row untouched) and against a user whose privileges the caller holds (allowed).

• go test ./pkg/server/services passes with the change.
• The new test fails without the change to users.go.

🤖 Generated with Claude Code