From 74e8c2761c7a8bc4aa467dd0dc66b465f174d44b Mon Sep 17 00:00:00 2001 From: MoQu Date: Tue, 1 Sep 2026 08:43:39 +0200 Subject: [PATCH 1/2] feat: admin can't revoke their own role --- .../template/user/UserController.java | 14 ++++++++++++++ .../resources/messages/user/messages_en.properties | 1 + .../resources/messages/user/messages_fr.properties | 1 + 3 files changed, 16 insertions(+) diff --git a/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java b/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java index e0ef4bbd..e9a7ae47 100644 --- a/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java +++ b/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java @@ -259,6 +259,20 @@ public Mono> revokeAdmin(@RequestHeader("Authorization") @PreAuthorize("hasAuthority('user:update')") public Mono> downgradeAdmin(@RequestHeader("Authorization") String token, @PathVariable String userLogin) { + + Authentication authentication = SecurityContextHolder + .getContext() + .getAuthentication(); + + UserDto current_user = (UserDto) authentication.getPrincipal(); + if (current_user.getLogin().equals(userLogin)) { + String message = messageSource.getMessage( + "user.downgrade.self", + null, + LocaleContextHolder.getLocale()); + return Mono.just(ResponseEntity.badRequest().body(message)); + } + // Call auth service to downgrade admin to manager globally return authClient.downgradeAdmin(token, userLogin) .flatMap(response -> { diff --git a/backend/src/main/resources/messages/user/messages_en.properties b/backend/src/main/resources/messages/user/messages_en.properties index 121873b1..ef1ed92f 100644 --- a/backend/src/main/resources/messages/user/messages_en.properties +++ b/backend/src/main/resources/messages/user/messages_en.properties @@ -24,3 +24,4 @@ user.duplicate=Duplicate user detected: {0} user.delete.permanent.failed=Failed to permanently delete user: {0} user.deleted.local=Local user deleted successfully user.promoted.local=User promoted to local app role successfully +user.downgrade.self=You cannot downgrade your own role diff --git a/backend/src/main/resources/messages/user/messages_fr.properties b/backend/src/main/resources/messages/user/messages_fr.properties index c3b7a6b6..5ddc72f0 100644 --- a/backend/src/main/resources/messages/user/messages_fr.properties +++ b/backend/src/main/resources/messages/user/messages_fr.properties @@ -24,3 +24,4 @@ user.duplicate=Utilisateur en double détecté : {0} user.delete.permanent.failed=Échec de la suppression définitive de l''utilisateur : {0} user.deleted.local=Utilisateur local supprimé avec succès user.promoted.local=Utilisateur promu au rôle local de l''application avec succès +user.downgrade.self=Vous ne pouvez pas rétrograder votre propre rôle \ No newline at end of file From 56323e348eb01bcebb3936b7fe34e7f925541f5b Mon Sep 17 00:00:00 2001 From: MoQu Date: Tue, 1 Sep 2026 09:00:28 +0200 Subject: [PATCH 2/2] fix: change variable name --- .../ch/sectioninformatique/template/user/UserController.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java b/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java index e9a7ae47..9f874cb5 100644 --- a/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java +++ b/backend/src/main/java/ch/sectioninformatique/template/user/UserController.java @@ -264,8 +264,8 @@ public Mono> downgradeAdmin(@RequestHeader("Authorization .getContext() .getAuthentication(); - UserDto current_user = (UserDto) authentication.getPrincipal(); - if (current_user.getLogin().equals(userLogin)) { + UserDto currentUser = (UserDto) authentication.getPrincipal(); + if (currentUser.getLogin().equals(userLogin)) { String message = messageSource.getMessage( "user.downgrade.self", null,