fix(auth): allow admins to change any username including their own

services/api/internal/auth/admin_test.go

@@ -76,6 +76,34 @@ func TestAdminCreatesModeratorWhoCreatesUser(t *testing.T) {
 	assert.Equal(t, auth.CodeForbidden, e.createUser(listener, "another", "user").code())
 }
 
+func TestAdminChangesUsername(t *testing.T) {
+	e := newEnv(t)
+	root := e.addUser("root", "root-password-1", auth.RoleAdmin)
+	listener := e.addUser("listener", "listener-password-1", auth.RoleUser)
+	mod := e.addUser("mod", "mod-password-1", auth.RoleModerator)
+	tok := e.signIn("root", "root-password-1")
+	patch := func(token string, id uuid.UUID, username string) resp {
+		return e.do(http.MethodPatch, "/api/v1/admin/users/"+id.String(), map[string]any{"username": username}, bearer(token))
+	}
+	for _, target := range []auth.User{listener, mod, root} {
+		r := patch(tok, target.ID, "  NEW."+target.Username+"  ")
+		require.Equal(t, http.StatusOK, r.Code, r.Body.String())
+		assert.Equal(t, "new."+target.Username, r.body["username"])
+		assert.Equal(t, "user.username_change", e.store.Audit[len(e.store.Audit)-1].Action)
+		assert.Equal(t, http.StatusOK, e.login("new."+target.Username, map[uuid.UUID]string{
+			root.ID: "root-password-1", listener.ID: "listener-password-1", mod.ID: "mod-password-1",
+		}[target.ID], "web").Code)
+	}
+	assert.Equal(t, http.StatusOK, e.do(http.MethodGet, "/api/v1/me", nil, bearer(tok)).Code, "own rename preserves session")
+	assert.Equal(t, auth.CodeUsernameTaken, patch(tok, listener.ID, "NEW.ROOT").code())
+	assert.Equal(t, auth.CodeUsernameInvalid, patch(tok, listener.ID, "invalid space").code())
+	assert.Equal(t, auth.CodeUsernameInvalid, patch(tok, listener.ID, "").code())
+	assert.Equal(t, "new.listener", e.store.Users[listener.ID].Username)
+	modTok := e.signIn("new.mod", "mod-password-1")
+	assert.Equal(t, auth.CodeForbidden, patch(modTok, listener.ID, "forbidden").code())
+	assert.Equal(t, auth.CodeForbidden, patch(modTok, mod.ID, "forbidden").code())
+}
+
 func TestCreateUserValidation(t *testing.T) {
 	e := newEnv(t)
 	e.addUser("root", "root-password-1", auth.RoleAdmin)