The admin role has no guard: the last administrator (or yourself) can be removed #835

New issue

Closed

opened 2026-09-26 14:03:38 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-26 14:03:38 +00:00

Collaborator

Found by the lane 9 survey (#735). PATCH /admin/users/{id}/admin (routers/users.py:553) has no checks, so:

an administrator can remove their own admin role;
the last administrator can be demoted, which leaves the server with nobody who can reach Admin.

The survey also suspects an administrator can delete their own account without a guard. It didn't read the whole deletion service, so that part needs checking.

The fix:

refuse (409, with a plain detail) removing the last administrator, and removing yourself;
decide the deletion case in the same way.

This pairs with D68's server owner (lane 9 PR A: migration, backfill, a set_owner CLI). The owner can't be demoted or deleted without handing the server on first.

Refs #735.

Found by the lane 9 survey (#735). `PATCH /admin/users/{id}/admin` (`routers/users.py:553`) has no checks, so: - an administrator can remove their own admin role; - the last administrator can be demoted, which leaves the server with nobody who can reach Admin. The survey also suspects an administrator can delete their own account without a guard. It didn't read the whole deletion service, so that part needs checking. **The fix:** - refuse (409, with a plain `detail`) removing the last administrator, and removing yourself; - decide the deletion case in the same way. This pairs with D68's server owner (lane 9 PR A: migration, backfill, a `set_owner` CLI). The owner can't be demoted or deleted without handing the server on first. Refs #735.