#890 - Prevent filtering users by role if requestor doesn't have "list_users" capability

[jasonbahl]

What does this implement/fix? Explain your changes.

Public requests shouldn't be able to filter users by role. This ensures that if the users connection is filtered

Before this, an unauthenticated user could make a request like the following:

query getUsers{
  users(where:{role:ADMINISTRATOR}){
    edges{
      node{
        userId
        name
      }
    }
  }
}

Get a response like:

{
  "data": {
    "users": {
      "edges": [
        {
          "node": {
            "userId": 1,
            "name": "root"
          }
        }
      ]
    }
  }
}

And the requestor would be able to determine which users are admins.

With this fix, the same request could be sent and the following response would be provided:

{
  "errors": [
    {
      "message": "Sorry, you are not allowed to filter users by role.",
      "category": "user",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "users"
      ]
    }
  ],
  "data": {
    "users": null
  },
}

Does this close any currently open issues?

closes #890

Any other comments?

Includes tests!

Where has this been tested?

Operating System: Mac OSX 10.14.5
WordPress Version: WP 5.2.2

[codecov]

Codecov Report

Merging #900 into develop will increase coverage by <.01%.
The diff coverage is 70%.

@@            Coverage Diff             @@
##           develop    #900      +/-   ##
==========================================
+ Coverage     60.8%   60.8%   +<.01%     
==========================================
  Files          132     132              
  Lines         7809    7817       +8     
==========================================
+ Hits          4748    4753       +5     
- Misses        3061    3064       +3

Impacted Files	Coverage Δ
src/Data/Connection/UserConnectionResolver.php	72.09% <70%> (-2.2%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c299157...5232908. Read the comment docs.