Merge pull request #18927 from abpframework/ManageRoles

Add `ManageRoles` permission.

modules/identity/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissionDefinitionProvider.cs

@@ -21,6 +21,7 @@ public class IdentityPermissionDefinitionProvider : PermissionDefinitionProvider
         usersPermission.AddChild(IdentityPermissions.Users.Update, L("Permission:Edit"));
         usersPermission.AddChild(IdentityPermissions.Users.Delete, L("Permission:Delete"));
         usersPermission.AddChild(IdentityPermissions.Users.ManagePermissions, L("Permission:ChangePermissions"));
+        usersPermission.AddChild(IdentityPermissions.Users.ManageRoles, L("Permission:ManageRoles"));
 
         identityGroup
             .AddPermission(IdentityPermissions.UserLookup.Default, L("Permission:UserLookup"))

modules/identity/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissions.cs

@@ -22,6 +22,7 @@ public static class IdentityPermissions
         public const string Update = Default + ".Update";
         public const string Delete = Default + ".Delete";
         public const string ManagePermissions = Default + ".ManagePermissions";
+        public const string ManageRoles = Update + ".ManageRoles";
     }
 
     public static class UserLookup

modules/identity/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityUserAppService.cs

@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Options;
 using Volo.Abp.Application.Dtos;
+using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Data;
 using Volo.Abp.ObjectExtending;
 
@@ -16,17 +17,19 @@ public class IdentityUserAppService : IdentityAppServiceBase, IIdentityUserAppSe
     protected IIdentityUserRepository UserRepository { get; }
     protected IIdentityRoleRepository RoleRepository { get; }
     protected IOptions<IdentityOptions> IdentityOptions { get; }
-
+    protected IPermissionChecker PermissionChecker { get; }
     public IdentityUserAppService(
         IdentityUserManager userManager,
         IIdentityUserRepository userRepository,
         IIdentityRoleRepository roleRepository,
-        IOptions<IdentityOptions> identityOptions)
+        IOptions<IdentityOptions> identityOptions,
+        IPermissionChecker permissionChecker)
     {
         UserManager = userManager;
         UserRepository = userRepository;
         RoleRepository = roleRepository;
         IdentityOptions = identityOptions;
+        PermissionChecker = permissionChecker;
     }
 
     //TODO: [Authorize(IdentityPermissions.Users.Default)] should go the IdentityUserAppService class.
@@ -169,6 +172,7 @@ public class IdentityUserAppService : IdentityAppServiceBase, IIdentityUserAppSe
             (await UserManager.SetEmailAsync(user, input.Email)).CheckErrors();
         }
 
+
         if (!string.Equals(user.PhoneNumber, input.PhoneNumber, StringComparison.InvariantCultureIgnoreCase))
         {
             (await UserManager.SetPhoneNumberAsync(user, input.PhoneNumber)).CheckErrors();
@@ -183,7 +187,7 @@ public class IdentityUserAppService : IdentityAppServiceBase, IIdentityUserAppSe
         user.Surname = input.Surname;
         (await UserManager.UpdateAsync(user)).CheckErrors();
         user.SetIsActive(input.IsActive);
-        if (input.RoleNames != null)
+        if (input.RoleNames != null && await PermissionChecker.IsGrantedAsync(IdentityPermissions.Users.ManageRoles))
         {
             (await UserManager.SetRolesAsync(user, input.RoleNames)).CheckErrors();
         }

modules/identity/src/Volo.Abp.Identity.Blazor/Pages/Identity/UserManagement.razor

@@ -179,7 +179,10 @@
                         <Tabs @bind-SelectedTab="@EditModalSelectedTab">
                             <Items>
                                 <Tab Name="UserInformations">@L["UserInformations"]</Tab>
-                                <Tab Name="Roles">@L["Roles"]</Tab>
+                                @if (EditUserRoles != null && EditUserRoles.Any())
+                                {
+                                    <Tab Name="Roles">@L["Roles"]</Tab>
+                                }
                             </Items>
                             <Content>
                                 <TabPanel Name="UserInformations">
@@ -258,18 +261,21 @@
                                     </Field>
                                     <ExtensionProperties TEntityType="IdentityUserUpdateDto" TResourceType="IdentityResource" Entity="@EditingEntity" LH="@LH" ModalType="ExtensionPropertyModalType.EditModal" />
                                 </TabPanel>
-                                <TabPanel Name="Roles">
+                                @if (EditUserRoles != null && EditUserRoles.Any())
-                                    @if (EditUserRoles != null)
+                                {
-                                    {
+                                    <TabPanel Name="Roles">
-                                        @foreach (var role in EditUserRoles)
+                                        @if (EditUserRoles != null)
                                         {
-                                            <Field>
+                                            @foreach (var role in EditUserRoles)
-                                                <input type="hidden" @bind-value="@role.Name" />
+                                            {
-                                                <Check TValue="bool" @bind-Checked="@role.IsAssigned">@role.Name</Check>
+                                                <Field>
-                                            </Field>
+                                                    <input type="hidden" @bind-value="@role.Name" />
+                                                    <Check TValue="bool" @bind-Checked="@role.IsAssigned">@role.Name</Check>
+                                                </Field>
+                                            }
                                         }
-                                    }
+                                    </TabPanel>
-                                </TabPanel>
+                                }
                             </Content>
                         </Tabs>
                     </Validations>

modules/identity/src/Volo.Abp.Identity.Blazor/Pages/Identity/UserManagement.razor.cs

@@ -4,9 +4,11 @@ using System.Linq;
 using System.Threading.Tasks;
 using Blazorise;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Components;
 using Volo.Abp.AspNetCore.Components.Web.Extensibility.EntityActions;
 using Volo.Abp.AspNetCore.Components.Web.Extensibility.TableColumns;
 using Volo.Abp.AspNetCore.Components.Web.Theming.PageToolbars;
+using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Identity.Localization;
 using Volo.Abp.ObjectExtending;
 using Volo.Abp.PermissionManagement.Blazor.Components;
@@ -43,6 +45,9 @@ public partial class UserManagement
     private TextRole _passwordTextRole = TextRole.Password;
     public bool IsEditCurrentUser { get; set; }
 
+    [Inject]
+    protected IPermissionChecker PermissionChecker { get; set; }
+
     public UserManagement()
     {
         ObjectMapperContext = typeof(AbpIdentityBlazorModule);
@@ -121,15 +126,19 @@ public partial class UserManagement
         {
             EditModalSelectedTab = DefaultSelectedTab;
             IsEditCurrentUser = entity.Id == CurrentUser.Id;
-            var userRoleNames = (await AppService.GetRolesAsync(entity.Id)).Items.Select(r => r.Name).ToList();
 
-            EditUserRoles = Roles.Select(x => new AssignedRoleViewModel
+            if (await PermissionChecker.IsGrantedAsync(IdentityPermissions.Users.ManageRoles))
             {
-                Name = x.Name,
+                var userRoleNames = (await AppService.GetRolesAsync(entity.Id)).Items.Select(r => r.Name).ToList();
-                IsAssigned = userRoleNames.Contains(x.Name)
+
-            }).ToArray();
+                EditUserRoles = Roles.Select(x => new AssignedRoleViewModel
+                {
+                    Name = x.Name,
+                    IsAssigned = userRoleNames.Contains(x.Name)
+                }).ToArray();
 
-            ChangePasswordTextRole(TextRole.Password);
+                ChangePasswordTextRole(TextRole.Password);
+            }
             await base.OpenEditModalAsync(entity);
         }
         catch (Exception ex)
@@ -141,8 +150,10 @@ public partial class UserManagement
     protected override Task OnUpdatingEntityAsync()
     {
         // apply roles before saving
-        EditingEntity.RoleNames = EditUserRoles.Where(x => x.IsAssigned).Select(x => x.Name).ToArray();
+        if (EditUserRoles != null)
-
+        {
+            EditingEntity.RoleNames = EditUserRoles.Where(x => x.IsAssigned).Select(x => x.Name).ToArray();
+        }
         return base.OnUpdatingEntityAsync();
     }
 

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ar.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "تحرير",
     "Permission:Delete": "حذف",
     "Permission:ChangePermissions": "تغيير الأذونات",
+    "Permission:ManageRoles": "إدارة الأدوار",
     "Permission:UserManagement": "إدارة المستخدم",
     "Permission:UserLookup": "بحث المستخدم",
     "DisplayName:Abp.Identity.Password.RequiredLength": "الطول المطلوب",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/cs.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Upravit",
     "Permission:Delete": "Smazat",
     "Permission:ChangePermissions": "Změnit oprávnění",
+    "Permission:ManageRoles": "Správa rolí",
     "Permission:UserManagement": "Správa uživatelů",
     "Permission:UserLookup": "Vyhledání uživatele",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Požadovaná délka",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/de.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Bearbeiten",
     "Permission:Delete": "Löschen",
     "Permission:ChangePermissions": "Berechtigungen ändern",
+    "Permission:ManageRoles": "Rollen verwalten",
     "Permission:UserManagement": "Benutzerverwaltung",
     "Permission:UserLookup": "Benutzersuche",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Erforderliche Länge",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/el.json

@@ -84,6 +84,7 @@
     "Permission:Edit": "Επεξεργασία",
     "Permission:Delete": "Διαγραφή",
     "Permission:ChangePermissions": "Αλλαγές στα δικαιώματα",
+    "Permission:ManageRoles": "Διαχείριση ρόλων",
     "Permission:UserManagement": "Διαχείριση χρηστών",
     "Permission:UserLookup": "Αναζήτηση χρήστη",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Απαιτούμενο μήκος",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en-GB.json

@@ -83,6 +83,7 @@
     "Permission:Edit": "Edit",
     "Permission:Delete": "Delete",
     "Permission:ChangePermissions": "Change permissions",
+    "Permission:ManageRoles": "Manage roles",
     "Permission:UserManagement": "User management",
     "Permission:UserLookup": "User lookup",
     "Feature:IdentityGroup": "Identity",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Edit",
     "Permission:Delete": "Delete",
     "Permission:ChangePermissions": "Change permissions",
+    "Permission:ManageRoles": "Manage roles",
     "Permission:UserManagement": "User management",
     "Permission:UserLookup": "User lookup",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Required length",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/es.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Editar",
     "Permission:Delete": "Borrar",
     "Permission:ChangePermissions": "Cambiar permisos",
+    "Permission:ManageRoles": "Gestionar roles",
     "Permission:UserManagement": "Gestión de usuarios",
     "Permission:UserLookup": "Busqueda de usuario",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Longitud requerida",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fa.json

@@ -84,6 +84,7 @@
     "Permission:Edit": "ویرایش",
     "Permission:Delete": "حذف",
     "Permission:ChangePermissions": "تغییر مجوزها",
+    "Permission:ManageRoles": "مدیریت نقشها و وظایف",
     "Permission:UserManagement": "مدیریت کاربر",
     "Permission:UserLookup": "جستجوی کاربر",
     "DisplayName:Abp.Identity.Password.RequiredLength": "طول مورد نیاز",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fi.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Muokkaus",
     "Permission:Delete": "Poisto",
     "Permission:ChangePermissions": "Muuta käyttöoikeuksia",
+    "Permission:ManageRoles": "Hallitse rooleja",
     "Permission:UserManagement": "Käyttäjien hallinta",
     "Permission:UserLookup": "Käyttäjähaku",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Vaadittu pituus",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fr.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Modifier",
     "Permission:Delete": "Supprimer",
     "Permission:ChangePermissions": "Modifier les autorisations",
+    "Permission:ManageRoles": "Gérer les rôles",
     "Permission:UserManagement": "Gestion des utilisateurs",
     "Permission:UserLookup": "Recherche utilisateur",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Longueur requise",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hi.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "संपादित करें",
     "Permission:Delete": "हटाएं",
     "Permission:ChangePermissions": "अनुमतियाँ बदलें",
+    "Permission:ManageRoles": "भूमिकाएँ प्रबंधित करें",
     "Permission:UserManagement": "उपयोगकर्ता प्रबंधन",
     "Permission:UserLookup": "उपयोगकर्ता की खोज",
     "DisplayName:Abp.Identity.Password.RequiredLength": "आवश्यक लंबाई",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hr.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Uredi",
     "Permission:Delete": "Izbrisati",
     "Permission:ChangePermissions": "Promjena dopuštenja",
+    "Permission:ManageRoles": "Upravljanje ulogama",
     "Permission:UserManagement": "Upravljanje korisnicima",
     "Permission:UserLookup": "Traženje korisnika",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Potrebna dužina",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hu.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Szerkesztés",
     "Permission:Delete": "Törlés",
     "Permission:ChangePermissions": "Engedélyek módosítása",
+    "Permission:ManageRoles": "Szerepkörök kezelése",
     "Permission:UserManagement": "Felhasználókezelés",
     "Permission:UserLookup": "Felhaszáló keresés",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Szükséges hossz",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/is.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Breyta",
     "Permission:Delete": "Eyða",
     "Permission:ChangePermissions": "Breyta heimildum",
+    "Permission:ManageRoles": "Hlutverka umsjón",
     "Permission:UserManagement": "Notanda umsjón",
     "Permission:UserLookup": "Leita að notanda",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Nauðsynleg lengdh",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/it.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Modifica",
     "Permission:Delete": "Elimina",
     "Permission:ChangePermissions": "Modifica le autorizzazioni",
+    "Permission:ManageRoles": "Gestione ruoli",
     "Permission:UserManagement": "Gestione utenti",
     "Permission:UserLookup": "Ricerca utente",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Lunghezza richiesta",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/nl.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Verander",
     "Permission:Delete": "Verwijder",
     "Permission:ChangePermissions": "Wijzig de rechten",
+    "Permission:ManageRoles": "Beheer rollen",
     "Permission:UserManagement": "Gebruikersbeheer",
     "Permission:UserLookup": "Gebruiker opzoeken",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Vereiste lengte",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pl-PL.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Edytuj",
     "Permission:Delete": "Usuń",
     "Permission:ChangePermissions": "Zmień uprawnienia",
+    "Permission:ManageRoles": "Zarządzaj rolami",
     "Permission:UserManagement": "Zarządzanie użytkownikami",
     "Permission:UserLookup": "Wyszukiwanie użytkownika",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Wymagana długość",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pt-BR.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Editar",
     "Permission:Delete": "Excluir",
     "Permission:ChangePermissions": "Alterar Permissões",
+    "Permission:ManageRoles": "Gerenciar Perfis",
     "Permission:UserManagement": "Usuários",
     "Permission:UserLookup": "Pesquisa de usuário",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Comprimento requerido",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ro-RO.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Editează",
     "Permission:Delete": "Şterge",
     "Permission:ChangePermissions": "Schimbă permisiunile",
+    "Permission:ManageRoles": "Administrarea rolurilor",
     "Permission:UserManagement": "Administrarea utilizatorilor",
     "Permission:UserLookup": "Căutarea utilizatorilor",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Lungimea necesară",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ru.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Редактировать",
     "Permission:Delete": "Удалить",
     "Permission:ChangePermissions": "Изменить разрешения",
+    "Permission:ManageRoles": "Управление ролями",
     "Permission:UserManagement": "Управление пользователями",
     "Permission:UserLookup": "Поиск пользователя",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Требуемая длина",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sk.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Upraviť",
     "Permission:Delete": "Zmazať",
     "Permission:ChangePermissions": "Zmeniť oprávnenia",
+    "Permission:ManageRoles": "Správa rolí",
     "Permission:UserManagement": "Správa používateľov",
     "Permission:UserLookup": "Vyhľadať používateľov",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Požadovaná dĺžka",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sl.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Urejanje",
     "Permission:Delete": "Brisanje",
     "Permission:ChangePermissions": "Spreminjanje dovoljenj",
+    "Permission:ManageRoles": "Upravljanje vlog",
     "Permission:UserManagement": "Upravljanje uporabnikov",
     "Permission:UserLookup": "Iskanje uporabnikov",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Zahtevana dolžina",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/tr.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Düzenleme",
     "Permission:Delete": "Silme",
     "Permission:ChangePermissions": "İzinleri değiştirme",
+    "Permission:ManageRoles": "Rolleri yönetme",
     "Permission:UserManagement": "Kullanıcı yönetimi",
     "Permission:UserLookup": "Kullanıcı sorgulama",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Uzunluk gerekli",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/vi.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "Sửa",
     "Permission:Delete": "Xóa",
     "Permission:ChangePermissions": "Thay đổi quyền",
+    "Permission:ManageRoles": "Quản lý vai trò",
     "Permission:UserManagement": "Quản lý người dùng",
     "Permission:UserLookup": "Tra cứu người dùng",
     "DisplayName:Abp.Identity.Password.RequiredLength": "Chiều dài yêu cầu",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hans.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "编辑",
     "Permission:Delete": "删除",
     "Permission:ChangePermissions": "更改权限",
+    "Permission:ManageRoles": "管理角色",
     "Permission:UserManagement": "用户管理",
     "Permission:UserLookup": "用户查询",
     "DisplayName:Abp.Identity.Password.RequiredLength": "要求长度",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hant.json

@@ -85,6 +85,7 @@
     "Permission:Edit": "編輯",
     "Permission:Delete": "刪除",
     "Permission:ChangePermissions": "更改權限",
+    "Permission:ManageRoles": "管理角色",
     "Permission:UserManagement": "使用者管理",
     "Permission:UserLookup": "使用者查詢",
     "DisplayName:Abp.Identity.Password.RequiredLength": "長度需符合",

modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Users/EditModal.cshtml

@@ -66,25 +66,28 @@
                                 else
                                 {
                                     <abp-input type="@propertyInfo.GetInputType()"
-                                            asp-for="UserInfo.ExtraProperties[propertyInfo.Name]"
+                                               asp-for="UserInfo.ExtraProperties[propertyInfo.Name]"
-                                            label="@propertyInfo.GetLocalizedDisplayName(StringLocalizerFactory)"
+                                               label="@propertyInfo.GetLocalizedDisplayName(StringLocalizerFactory)"
-                                            asp-format="@propertyInfo.GetInputFormatOrNull()"
+                                               asp-format="@propertyInfo.GetInputFormatOrNull()"
-                                            value="@propertyInfo.GetInputValueOrNull(Model.UserInfo.GetProperty(propertyInfo.Name))" />
+                                               value="@propertyInfo.GetInputValueOrNull(Model.UserInfo.GetProperty(propertyInfo.Name))" />
                                 }
                             }
                         }
                     </div>
                 </abp-tab>
-                <abp-tab title="@L["Roles"].Value">
+                @if (Model.Roles.Any())
-                    <div class="mt-3" >
+                {
-                        @for (var i = 0; i < Model.Roles.Length; i++)
+                    <abp-tab title="@L["Roles"].Value">
-                        {
+                        <div class="mt-3" >
-                            var role = Model.Roles[i];
+                            @for (var i = 0; i < Model.Roles.Length; i++)
-                            <abp-input abp-id-name="@Model.Roles[i].IsAssigned" asp-for="@role.IsAssigned" label="@role.Name" />
+                            {
-                            <input abp-id-name="@Model.Roles[i].Name" asp-for="@role.Name" />
+                                var role = Model.Roles[i];
-                        }
+                                <abp-input abp-id-name="@Model.Roles[i].IsAssigned" asp-for="@role.IsAssigned" label="@role.Name" />
-                    </div>
+                                <input abp-id-name="@Model.Roles[i].Name" asp-for="@role.Name" />
-                </abp-tab>
+                            }
+                        </div>
+                    </abp-tab>
+                }
                 <abp-tab title="@L["Details"].Value">
                     <div class="mt-3">
                         <div class="mb-3">

modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Users/EditModal.cshtml.cs

@@ -6,6 +6,7 @@ using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc;
 using Volo.Abp.Auditing;
 using Volo.Abp.Application.Dtos;
+using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Domain.Entities;
 using Volo.Abp.ObjectExtending;
 using Volo.Abp.Validation;
@@ -24,18 +25,24 @@ public class EditModalModel : IdentityPageModel
 
     protected IIdentityUserAppService IdentityUserAppService { get; }
 
+    protected IPermissionChecker PermissionChecker { get; }
+
     public bool IsEditCurrentUser { get; set; }
 
-    public EditModalModel(IIdentityUserAppService identityUserAppService)
+    public EditModalModel(IIdentityUserAppService identityUserAppService, IPermissionChecker permissionChecker)
     {
         IdentityUserAppService = identityUserAppService;
+        PermissionChecker = permissionChecker;
     }
 
     public virtual async Task<IActionResult> OnGetAsync(Guid id)
     {
         var user = await IdentityUserAppService.GetAsync(id);
         UserInfo = ObjectMapper.Map<IdentityUserDto, UserInfoViewModel>(user);
-        Roles = ObjectMapper.Map<IReadOnlyList<IdentityRoleDto>, AssignedRoleViewModel[]>((await IdentityUserAppService.GetAssignableRolesAsync()).Items);
+        if (await PermissionChecker.IsGrantedAsync(IdentityPermissions.Users.ManageRoles))
+        {
+            Roles = ObjectMapper.Map<IReadOnlyList<IdentityRoleDto>, AssignedRoleViewModel[]>((await IdentityUserAppService.GetAssignableRolesAsync()).Items);
+        }
         IsEditCurrentUser = CurrentUser.Id == id;
 
         var userRoleNames = (await IdentityUserAppService.GetRolesAsync(UserInfo.Id)).Items.Select(r => r.Name).ToList();