YALB-1554: Remove "Platform admin" from options for site admins when …

…adding or managing site users (#426)

* feat(YALB-1554): add role_delegation module
* feat(YALB-1554): enable role_delegation
* feat(YALB-1554): set role_delegation permissions
* fix(YALB-1554): bulk_add_cas_users respect role_delegate

The CAS module has a bulk add form which does not respect the role
delegation set in the role_delegegate module.  This overrides the
options for the role to only include those that they are allowed to set
specified by the role_delegate settings.

web/profiles/custom/yalesites_profile/composer.json

@@ -75,6 +75,7 @@
     "drupal/recaptcha": "^3.1",
     "drupal/recaptcha_v3": "^1.7",
     "drupal/redirect": "^1.7",
+    "drupal/role_delegation": "^1.2",
     "drupal/search_api": "^1.25",
     "drupal/search_api_exclude": "^2.0",
     "drupal/search_api_html_element_filter": "^1.0",

web/profiles/custom/yalesites_profile/config/sync/core.extension.yml

@@ -104,6 +104,7 @@ module:
   redirect: 0
   redirect_404: 0
   responsive_image: 0
+  role_delegation: 0
   search_api: 0
   search_api_db: 0
   search_api_exclude: 0

web/profiles/custom/yalesites_profile/config/sync/user.role.platform_admin.yml

@@ -35,6 +35,7 @@ dependencies:
     - publishcontent
     - quick_node_clone
     - redirect
+    - role_delegation
     - system
     - taxonomy
     - toolbar
@@ -61,6 +62,8 @@ permissions:
   - 'administer redirects'
   - 'administer users'
   - 'administer utility-navigation menu items'
+  - 'assign platform_admin role'
+  - 'assign site_admin role'
   - 'clone event content'
   - 'clone page content'
   - 'clone post content'

web/profiles/custom/yalesites_profile/config/sync/user.role.site_admin.yml

@@ -34,6 +34,7 @@ dependencies:
     - publishcontent
     - quick_node_clone
     - redirect
+    - role_delegation
     - system
     - taxonomy
     - toolbar
@@ -58,6 +59,7 @@ permissions:
   - 'administer redirects'
   - 'administer users'
   - 'administer utility-navigation menu items'
+  - 'assign site_admin role'
   - 'clone event content'
   - 'clone page content'
   - 'clone post content'

web/profiles/custom/yalesites_profile/modules/custom/ys_core/ys_core.module

@@ -75,6 +75,15 @@ function ys_core_theme($existing, $type, $theme, $path): array {
  */
 function ys_core_form_alter(&$form, $form_state, $form_id) {
 
+  // Ensure the CAS bulk add only allows roles that role_delegate will allow.
+  if ($form_id == 'bulk_add_cas_users') {
+    $account = \Drupal::currentUser();
+    $delegatable_roles = \Drupal::service('delegatable_roles');
+
+    $delegatable_roles = $delegatable_roles->getAssignableRoles($account);
+    $form['roles']['#options'] = $delegatable_roles;
+  }
+
   // Load custom library.
   if (str_ends_with($form_id, '_layout_builder_form')) {
     $form['#attached']['library'][] = 'ys_core/node_layout_form';