Site Administrator can't access user controlpanel

Describe the bug A user with the Site Administrator role, receives an Unauthorized error, when trying to access the user’s controlpanel:

http://localhost:3000/controlpanel/users

Log:

2022-11-18 10:24:33 ERROR [Zope.SiteErrorLog:35][waitress-2] Unauthorized: http://localhost:3000/@roles
Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 167, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 376, in publish_module
  Module ZPublisher.WSGIPublisher, line 255, in publish
  Module ZPublisher.BaseRequest, line 641, in traverse
  Module ZPublisher.HTTPResponse, line 1017, in unauthorized
zExceptions.unauthorized.Unauthorized: You are not authorized to access this resource.

To Reproduce Steps to reproduce the behavior:

1. Create a user with the Site Administrator role
2. Logged in with this user, try to access the user’s controlpanel: http://localhost:3000/controlpanel/users

Expected behavior Allow the user to access the control panel

Software (please complete the following information):

OS: Ubuntu 22 Browser: Chrome Volto Version: 16.0.0-alpha.48 Plone Version 6.0.0b3 Plone REST API Version: 8.30.0

[davisagli]

I think plone.app.controlpanel.UsersAndGroups is the correct permission to use here.

[davisagli]

@wesleybl Excellent point. The classic UI users control panel has some checks for this (search for is_zope_manager in https://github.com/plone/Products.CMFPlone/blob/master/Products/CMFPlone/controlpanel/browser/usergroups_usersoverview.py) that need to be duplicated for the REST API.

There’s a good chance that the lack of these checks is why the control panel is restricted to the Manage portal permission so far.