Fix permissions handling so they're patched and not overridden

[n1k0]

Note that having more atomic endpoints/methods for dealing with perms update might greatly help, and this is currently discussed in https://github.com/Kinto/kinto/issues/458.

[leplatrem]

We could add two new methods:

• addPermission('write', ['github:me', 'basic:gjroepo4i94i9i'], options)
• removePermission('read', ['system.Everyone'], options)

Those two methods would perform a first call to retrieve the current permissions, then add/remove the specified principals, and perform a second call with patch using concurrency-control headers to prevent races.

Is that what you had in mind @n1k0 ?

[n1k0]

Without any specific syntax to do that in one request on the server endpoint, yes, exactly. Note that these two calls could be perform in a single batch operation anyway.

[leplatrem]

could be perform in a single batch operation anyway

I don't think so, since you need the response of the first one to perform the second one.

[n1k0]

Ah, true. No big deal anyway.

[leplatrem]

Now that JSON patch (https://tools.ietf.org/html/rfc6902) support was added by @gabisurita we could leverage it for manipulating permissions