Skip to content

Prevent users from removing their own admin roles - #543

Merged
bmtcril merged 1 commit into
mainfrom
bmtcril/fix-rbac-007
Oct 27, 2026
Merged

bmtcril merged 1 commit into
mainfrom
bmtcril/fix-rbac-007

Conversation

@bmtcril

@bmtcril bmtcril commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Closes #526

According to our BTR tests "If I am viewing my own user and the role is Library Admin, I cannot remove it". The admin console implements that in the UI only. It omits the delete control on your own admin row for a library scope, and leaves the Actions cell empty for a course scope. This closes the same gap on the admin side.

Merge checklist:
Check off if complete or not applicable:

  • Documentation updated (not only docstrings)
  • Fixup commits are squashed away
  • Unit tests added/updated
  • Manual testing instructions provided
  • Noted any: Concerns, dependencies, migration issues, deadlines, tickets

@bmtcril bmtcril changed the title fix: Users can't remove their own admin roles Prevent users from removing their own admin roles Oct 20, 2026

@rodmgwgu rodmgwgu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified in my local environment and works correctly, thanks!

@bmtcril
bmtcril merged commit b25d8e2 into main Oct 27, 2026
8 checks passed
@bmtcril
bmtcril deleted the bmtcril/fix-rbac-007 branch October 27, 2026 17:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DELETE /api/authz/v1/roles/users/ lets an admin remove its own admin role (UI-only guard)

2 participants