pub async fn grant(
read: &Read,
role: RoleId,
permission: &str,
) -> Result<RoleGrant>Expand description
Idempotent: a grant role already holds is returned unchanged. Checks nothing of who
grants, so it is for seeds and boot; a handler grants with grant_as.