jcoffey-dev
32559d5bd0
Permissions were compared only when they were what a change touched, and not at all on delete, so an administrator with account-update rights could reset the password of an administrator holding more, or delete the account. Changing or deleting an account now needs every permission it has. SCIM keeps managing every account on its domains, administrators included (SCIM-13). Requests through the SCIM endpoint skip the new check, and the permission change they make is checked for what it adds rather than for everything the account holds, so SCIM can turn off an administrator's sign-in and still can't grant anything its key lacks.