Prevent removal of last ADMIN role to avoid lockout #87

New Issue

claude · 2026-03-17T20:01:26+01:00

claude commented

2026-03-17 20:01:26 +01:00

Problem

If the last remaining user with the ADMIN role removes the role from themselves (or is deleted), all admin access is permanently lost. There is no way to recover without direct database intervention.

Expected Behavior

The system must enforce that at least one user always holds the ADMIN role. The following operations should be blocked when they would result in zero admin users:

Removing the ADMIN role from a user
Deleting a user who is the sole admin
Removing a user from a group that grants ADMIN (if it's their only source of the role)

The API should return a clear error (e.g. 409 Conflict) explaining why the operation was rejected.

Acceptance Criteria

Backend validates on role removal / user deletion that at least one ADMIN user remains
API returns a descriptive error when the operation would cause admin lockout
UI surfaces the error message to the admin attempting the action

## Problem If the last remaining user with the `ADMIN` role removes the role from themselves (or is deleted), all admin access is permanently lost. There is no way to recover without direct database intervention. ## Expected Behavior The system must enforce that at least one user always holds the `ADMIN` role. The following operations should be blocked when they would result in zero admin users: - Removing the `ADMIN` role from a user - Deleting a user who is the sole admin - Removing a user from a group that grants `ADMIN` (if it's their only source of the role) The API should return a clear error (e.g. `409 Conflict`) explaining why the operation was rejected. ## Acceptance Criteria - [ ] Backend validates on role removal / user deletion that at least one `ADMIN` user remains - [ ] API returns a descriptive error when the operation would cause admin lockout - [ ] UI surfaces the error message to the admin attempting the action

claude referenced this issue from a commit

2026-04-09 08:58:21 +02:00

feat: last-ADMIN guard and password hardening (#87, #89)

claude commented

2026-04-09 08:58:34 +02:00

Implemented in 827ba3c. Guards added in three locations:

RbacServiceImpl.removeRoleFromUser — blocks removing ADMIN role when only 1 effective admin remains
UserAdminController.deleteUser — blocks deleting a user who is the sole admin
GroupAdminController.removeRoleFromGroup — blocks removing ADMIN from a group when only 1 effective admin remains

All return 409 Conflict with descriptive error message.

Implemented in 827ba3c. Guards added in three locations: - `RbacServiceImpl.removeRoleFromUser` — blocks removing ADMIN role when only 1 effective admin remains - `UserAdminController.deleteUser` — blocks deleting a user who is the sole admin - `GroupAdminController.removeRoleFromGroup` — blocks removing ADMIN from a group when only 1 effective admin remains All return 409 Conflict with descriptive error message.

claude closed this issue

2026-04-09 08:58:35 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cameleer/cameleer-server#87