Roles '{flamenco,attract}-user' are now linked to 'subscriber'

All users who get 'subscriber' role automatically get 'flamenco-user' and
'attract-user', and when 'subscriber' is revoked, so are
'{flamenco,attract}-user'.

tests/abstract_cloud_test.py

@@ -0,0 +1,24 @@
+from pillar.tests import PillarTestServer, AbstractPillarTest
+
+
+class CloudTestServer(PillarTestServer):
+    def __init__(self, *args, **kwargs):
+        PillarTestServer.__init__(self, *args, **kwargs)
+
+        from flamenco import FlamencoExtension
+        from attract import AttractExtension
+        from cloud import CloudExtension
+
+        self.load_extension(FlamencoExtension(), '/flamenco')
+        self.load_extension(AttractExtension(), '/attract')
+        self.load_extension(CloudExtension(), None)
+
+
+class AbstractCloudTest(AbstractPillarTest):
+    pillar_server_class = CloudTestServer
+
+    def tearDown(self):
+        self.unload_modules('cloud')
+        self.unload_modules('attract')
+        self.unload_modules('flamenco')
+        AbstractPillarTest.tearDown(self)

tests/test_linked_roles.py

@@ -0,0 +1,17 @@
+from abstract_cloud_test import AbstractCloudTest
+
+
+class LinkedRolesTest(AbstractCloudTest):
+    def test_linked_roles(self):
+        user_id = self.create_user(roles=[])
+        db_user = self.fetch_user_from_db(user_id)
+
+        self.badger(db_user['email'], {'subscriber'}, 'grant')
+        db_user = self.fetch_user_from_db(user_id)
+        self.assertEqual({'subscriber', 'flamenco-user', 'attract-user'},
+                         set(db_user['roles']))
+
+        self.badger(db_user['email'], {'subscriber'}, 'revoke')
+        db_user = self.fetch_user_from_db(user_id)
+        self.assertEqual(set(),
+                         set(db_user.get('roles', [])))