Implement edit user modal

EditUserHandler is a bit rough

src/Api/Actions/Users/UpdateAction.php

@@ -21,7 +21,9 @@ class UpdateAction extends SerializeResourceAction
     /**
      * @inheritdoc
      */
-    public $include = [];
+    public $include = [
+        'groups' => true
+    ];
 
     /**
      * @inheritdoc

src/Api/Serializers/UserSerializer.php

@@ -29,8 +29,7 @@ class UserSerializer extends UserBasicSerializer
         if ($canEdit) {
             $attributes += [
                 'isActivated' => $user->is_activated,
-                'email'       => $user->email,
-                'isConfirmed' => $user->is_confirmed
+                'email'       => $user->email
             ];
         }
 

src/Core/Users/Commands/EditUserHandler.php

@@ -3,7 +3,9 @@
 use Flarum\Core\Users\User;
 use Flarum\Core\Users\UserRepository;
 use Flarum\Events\UserWillBeSaved;
+use Flarum\Events\UserGroupsWereChanged;
 use Flarum\Core\Support\DispatchesEvents;
+use Flarum\Core\Exceptions\PermissionDeniedException;
 
 class EditUserHandler
 {
@@ -33,38 +35,68 @@ class EditUserHandler
         $data = $command->data;
 
         $user = $this->users->findOrFail($command->userId, $actor);
-
-        $user->assertCan($actor, 'edit');
+        $isSelf = $actor->id === $user->id;
 
         $attributes = array_get($data, 'attributes', []);
+        $relationships = array_get($data, 'relationships', []);
 
         if (isset($attributes['username'])) {
-            $user->assertCan($actor, 'rename');
+            $user->assertCan($actor, 'edit');
             $user->rename($attributes['username']);
         }
 
         if (isset($attributes['email'])) {
-            $user->requestEmailChange($attributes['email']);
+            if ($isSelf) {
+                $user->requestEmailChange($attributes['email']);
+            } else {
+                $user->assertCan($actor, 'edit');
+                $user->changeEmail($attributes['email']);
+            }
         }
 
         if (isset($attributes['password'])) {
+            $user->assertCan($actor, 'edit');
             $user->changePassword($attributes['password']);
         }
 
         if (isset($attributes['bio'])) {
+            if (! $isSelf) {
+                $user->assertCan($actor, 'edit');
+            }
+
             $user->changeBio($attributes['bio']);
         }
 
         if (! empty($attributes['readTime'])) {
+            $this->assert($isSelf);
             $user->markAllAsRead();
         }
 
         if (! empty($attributes['preferences'])) {
+            $this->assert($isSelf);
+
             foreach ($attributes['preferences'] as $k => $v) {
                 $user->setPreference($k, $v);
             }
         }
 
+        if (isset($relationships['groups']['data']) && is_array($relationships['groups']['data'])) {
+            $user->assertCan($actor, 'edit');
+
+            $newGroupIds = [];
+            foreach ($relationships['groups']['data'] as $group) {
+                if ($id = array_get($group, 'id')) {
+                    $newGroupIds[] = $id;
+                }
+            }
+
+            $user->raise(new UserGroupsWereChanged($user, $user->groups()->get()->all()));
+
+            User::saved(function ($user) use ($newGroupIds) {
+                $user->groups()->sync($newGroupIds);
+            });
+        }
+
         event(new UserWillBeSaved($user, $actor, $data));
 
         $user->save();
@@ -72,4 +104,11 @@ class EditUserHandler
 
         return $user;
     }
+
+    protected function assert($true)
+    {
+        if (! $true) {
+            throw new PermissionDeniedException;
+        }
+    }
 }

src/Core/Users/UsersServiceProvider.php

@@ -29,11 +29,6 @@ class UsersServiceProvider extends ServiceProvider
 
         $events->listen(ModelAllow::class, function (ModelAllow $event) {
             if ($event->model instanceof User) {
-                if ($event->action === 'edit' &&
-                    $event->model->id == $event->actor->id) {
-                    return true;
-                }
-
                 if ($event->actor->hasPermission('user.'.$event->action)) {
                     return true;
                 }

src/Events/UserGroupsWereChanged.php

@@ -0,0 +1,28 @@
+<?php namespace Flarum\Events;
+
+use Flarum\Core\Users\User;
+
+class UserGroupsWereChanged
+{
+    /**
+     * The user whose groups were changed.
+     *
+     * @var User
+     */
+    public $user;
+
+    /**
+     * @var Flarum\Core\Groups\Group[]
+     */
+    public $oldGroups;
+
+    /**
+     * @param User $user The user whose groups were changed.
+     * @param Flarum\Core\Groups\Group[] $user
+     */
+    public function __construct(User $user, array $oldGroups)
+    {
+        $this->user = $user;
+        $this->oldGroups = $oldGroups;
+    }
+}