api: don't allow revoke admin status of DefaultAdmins

This commit is contained in:
Evan Goode 2025-02-02 21:24:39 -05:00
parent c16361c6bc
commit 1f48320a2f

View File

@ -328,6 +328,9 @@ func (app *App) UpdateUser(
if !callerIsAdmin { if !callerIsAdmin {
return User{}, NewBadRequestUserError("Cannot change admin status of user without having admin privileges yourself.") return User{}, NewBadRequestUserError("Cannot change admin status of user without having admin privileges yourself.")
} }
if !(*isAdmin) && app.IsDefaultAdmin(&user) {
return User{}, NewBadRequestUserError("Cannot revoke admin status of a default admin.")
}
user.IsAdmin = *isAdmin user.IsAdmin = *isAdmin
} }