This issue only occurs with modules hooks - it has no impact in pure Drupal core.
In Drupal core, there is a single permission 'administer users' that controls whether a user can 'administer' the user account of another user. However the Drupal 8 Entity API makes it possible to refine the access, for example by means of hook_entity_access. This allows modules such as Administer Users by Role to create a "sub-admin" - a user without 'administer users' permissions that nevertheless has access to update some other users' account.
Unfortunately RegisterForm, ProfileForm and UserCancelForm are broken when used by the sub-admin. The problems arise from the fact that each form can be used in two ways: a normal user can update their own account or an admin can administer another user.
Expected behaviour
Tthe sub-admin sees the same interface as the admin, except missing fields such as role that require additionaly access.
Actual behaviour
The sub-admin sees a confusing mixture of the user and admin interfaces, for example:
- After creating a user the sub-admin is logged in as that user.
- When cancelling an account the sub-admin see "Your account will be blocked and ..." but it's actually another users account.
- Several fields are missing due to lack of access.
Steps to reproduce
- Install Administer Users by Role release 8.x-2.0-alpha3.
- Create a role with permissions 'Create new users', 'Edit users with no custom roles', 'Cancel users with no custom roles', 'Access the users overview page', 'View user information'.
- Create user with this role, and log in as that user.
- Create a user.
Or if you prefer, can reproduce by writing custom code.
Workaround
It is possible to fix all the problems using the extensive hooks provided by the user module. However it took 95 lines of code in Administer Users by Role. What's more, this code has detailed dependencies on the internal implementation in the user module, so may need to be updated for future Drupal versions.
You can test the workaround if you also install the sub-module administerusersbyrole_hack. You must disable this sub-module to see the bug.
Solution
Fortunately it seems possible to fix the forms with some fairly simple changes to the user module, without any negative impact on mainline use cases. This seems valuable and worthwhile because any contrib or custom code hooking into User access is likely to see the same problems.
Patch coming up.