Protect the final administrator

2026-08-11 00:39:25 +02:00
parent e4cce9a004
commit 36c1e56efa
3 changed files with 33 additions and 3 deletions
@@ -5070,6 +5070,7 @@ async function refreshUserManagement() {
  const list = requiredElement("user-list");
  try {
    const users = await listUsers();
+    const adminCount = users.filter(user => user.role === "admin").length;
    list.replaceChildren(...users.map((user) => {
      const row = document.createElement("div");
      row.className = "sch-row";
@@ -5082,6 +5083,9 @@ async function refreshUserManagement() {
      for (const value of ["user", "admin"] as AuthRole[]) {
        const option = document.createElement("option"); option.value = value; option.textContent = value === "admin" ? "Admin" : "User"; option.selected = user.role === value; role.append(option);
      }
+      const isOnlyAdmin = user.role === "admin" && adminCount === 1;
+      role.disabled = isOnlyAdmin;
+      if (isOnlyAdmin) role.title = "The final administrator cannot be demoted";
      const password = document.createElement("input");
      password.type = "password"; password.placeholder = "New password"; password.autocomplete = "new-password"; password.className = "auth-input"; password.minLength = 8;
      const save = document.createElement("button"); save.type = "button"; save.textContent = "Save";
@@ -5091,7 +5095,8 @@ async function refreshUserManagement() {
        await runUserOperation(() => updateUser(user.username, changes));
      });
      const remove = document.createElement("button"); remove.type = "button"; remove.textContent = "Remove"; remove.className = "danger";
-      remove.disabled = user.username === authUsername;
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
      remove.addEventListener("click", async () => {
        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
          await runUserOperation(() => deleteUser(user.username));