userobjectroles added twice can't be deleted

[johnlawrenceaspden]

the add_user_to_role/remove_user_from_role functions are asymmetrical in that the add function is happy to add the same role twice but the remove asserts that it's only in the table once and crashes if that's not true.

an attempt has been made to guard against this, but fails, I think because the add functions rely on the caller committing the change to the db.

same problem affects corresponding authorization_group functions

I'll try to sort this out. Making a note here.

[johnlawrenceaspden]

Current behaviour:

from the web interface, russianfan can be added as an admin on warandpeace twice. and you can then delete the two roles separately. desired behaviour is that you can only add him once.

from the command line, you can only add him once, but if he's in there twice, you can't remove him because the command line bombs desired behaviour is that he can be removed

from the shell, you can add him twice but can't remove him if he's been added twice. if you try, it bombs.

The desired behaviour in all cases is that adding and removing are effective and idempotent in all three cases.

[johnlawrenceaspden]

It appears to be possible to get into a state where you can't add or remove roles from the command line. Investigating.

[johnlawrenceaspden]

Fixed the problem where you can't delete a role if it's been added twice, but had to leave the add function as it was since putting a commit in it breaks many tests.

It appears that the WUI doesn't call these functions anyway. Left that as it is since we're planning to replace it.

The cli rights command doesn't appear to add the roles that it says it adds. Possibly because it's not doing the required commit? Reported this as a different bug.