Fixed client-side permission check that decides if the add role action

for UserGroups is shown

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserService.java

@@ -512,6 +512,11 @@ public class UserService {
         return this.hasCurrentUserAnyPermission(createPermission, null);
     }
     
+    public boolean hasCurrentUserPermissionToUpdateAnyObjectOfType(HasPermissions type) {
+        final WildcardPermission createPermission = type.getPermission(DefaultActions.UPDATE);
+        return this.hasCurrentUserAnyPermission(createPermission, null);
+    }
+    
     public ServerInfoDTO getServerInfo() {
         return serverInfo;
     }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/AccessControlledButtonPanel.java

@@ -27,7 +27,7 @@ public class AccessControlledButtonPanel extends Composite {
     private final HorizontalPanel panel = new HorizontalPanel();
     private final Map<Button, Supplier<Boolean>> buttonToPermissions = new HashMap<>();
 
-    private final Supplier<Boolean> createPermissionCheck, removePermissionCheck;
+    private final Supplier<Boolean> createPermissionCheck, removePermissionCheck, updatePermissionCheck;
     private final BiConsumer<Button, Supplier<Boolean>> visibilityUpdater = (btn, check) -> btn.setVisible(check.get());
 
     /**
@@ -42,6 +42,7 @@ public class AccessControlledButtonPanel extends Composite {
     public AccessControlledButtonPanel(final UserService userService, final HasPermissions type) {
         this.createPermissionCheck = () -> userService.hasCurrentUserPermissionToCreateObjectOfType(type);
         this.removePermissionCheck = () -> userService.hasCurrentUserPermissionToDeleteAnyObjectOfType(type);
+        this.updatePermissionCheck = () -> userService.hasCurrentUserPermissionToUpdateAnyObjectOfType(type);
         userService.addUserStatusEventHandler((user, preAuth) -> updateVisibility(), true);
         initWidget(panel);
     }
@@ -103,6 +104,21 @@ public class AccessControlledButtonPanel extends Composite {
     public Button addRemoveAction(final String text, final Command callback) {
         return addAction(text, removePermissionCheck, callback);
     }
+    
+    /**
+     * Adds a secured action button, which is only visible if the current user has any
+     * {@link UserService#hasCurrentUserPermissionToUpdateAnyObjectOfType(HasPermissions) update permission} for the
+     * {@link HasPermissions type} provided in this {@link AccessControlledButtonPanel}'s constructor.
+     * 
+     * @param text
+     *            the {@link String text} to show on the button
+     * @param callback
+     *            the {@link Command callback} to execute on button click, if permission is granted
+     * @return the created {@link Button} instance
+     */
+    public Button addUpdateAction(final String text, final Command callback) {
+        return addAction(text, updatePermissionCheck, callback);
+    }
 
     /**
      * Adds an action button, which's visibility depends on the provided {@link Supplier permission check}.

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/usergroup/roles/UserGroupRoleDefinitionPanel.java

@@ -99,7 +99,7 @@ public class UserGroupRoleDefinitionPanel extends Composite
     private Widget createButtonPanel(final UserService userService, final StringMessages stringMessages) {
         final AccessControlledButtonPanel buttonPanel = new AccessControlledButtonPanel(userService, USER_GROUP);
         final UserManagementServiceAsync userManagementService = userService.getUserManagementService();
-        buttonPanel.addCreateAction(stringMessages.addRole(), () -> {
+        buttonPanel.addUpdateAction(stringMessages.addRole(), () -> {
             final UserGroupDTO selectedObject = userGroupSelectionModel.getSelectedObject();
             if (selectedObject != null) {
                 StrippedRoleDefinitionDTO role = ((RoleDefinitionSuggestOracle) suggestRole.getSuggestOracle())