diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:48:56 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:48:56 +0200 |
| commit | 9f95bf2deaec0c31e5fac95e1068db40b878e217 (patch) | |
| tree | d8a0f5f5ca2270d047a272b02f04796ee2606bba /docs/auth-confirm.md | |
| parent | 8a6294b0412a86f378c6e2e937c28de64a903c91 (diff) | |
| download | meshbay-9f95bf2deaec0c31e5fac95e1068db40b878e217.tar.gz | |
fix(hub): moderator can no longer grant admin or hard-revoke accounts
admin_patch_user was gated by require_moderator but wrote `role` and
`status` with no further check. A moderator could promote any account
(an accomplice) to admin, demote an existing admin, or set
status="revoked" — a straight path from the moderation role to full
instance control.
Split authorization by field: status between active/suspended stays
at require_moderator (reversible content moderation); role changes,
status="revoked", and touching an admin's account at all now require
user_is_admin(current_user) (new helper in deps.py, alongside the
existing require_admin/require_moderator).
Regression test: test_moderator_cannot_change_roles_or_revoke.
Third security review, finding H1.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG
Diffstat (limited to 'docs/auth-confirm.md')
0 files changed, 0 insertions, 0 deletions