On reflection, it's apparent that my code in stripes-core is working correctly based on the permissions supplied to it. So I am going to transfer the server-response problem into its own new issue, and close this one.
Mike Taylor July 14, 2017 at 2:36 PM
I have attached the current responses to login (which has the permission) and permissions (which does not). Surely this should be impossible?
Mike Taylor July 14, 2017 at 2:34 PM
Now I removed the settings.enabled permission from diku_admin – and I see the reverse problem. The /bl-users/login response contains the removed permission and the /perms/users/diku_admin/permissions response does not.
Mike Taylor July 14, 2017 at 2:31 PM
Infuriatingly, this is now working – I am getting back the correct set of permissions when I re-login.
The "Settings" menu should be displayed only when the user has the
settings.enabledpermission.