diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte index b321cf8..abc48f2 100644 --- a/src/routes/+layout.svelte +++ b/src/routes/+layout.svelte @@ -62,6 +62,14 @@ {/if} {#if data.user} + {#if data.user.globalRole === 'SITE_ADMIN'} + + Site Admin + + {/if} {#if data.user.tenantRole === 'ADMIN' || data.user.globalRole === 'SITE_ADMIN'}
(mobileMenuOpen = false)}>{data.user.name} + {#if data.user.globalRole === 'SITE_ADMIN'} + (mobileMenuOpen = false)} + > + Site Admin + + {/if} {#if data.user.tenantRole === 'ADMIN' || data.user.globalRole === 'SITE_ADMIN'} { const { users, boards, tags, categories } = await withTenant(tenant.id, async (tx) => { const [users, boards, tags, categories] = await Promise.all([ tx.user.findMany({ - where: { tenantId: tenant.id }, + where: { tenantId: tenant.id, globalRole: { not: 'SITE_ADMIN' } }, select: { id: true, name: true, email: true, tenantRole: true, - globalRole: true, createdAt: true }, orderBy: { createdAt: 'asc' } diff --git a/src/routes/admin/+page.svelte b/src/routes/admin/+page.svelte index eee4983..5d969a3 100644 --- a/src/routes/admin/+page.svelte +++ b/src/routes/admin/+page.svelte @@ -141,20 +141,21 @@ {user.name} - {#if user.globalRole === 'SITE_ADMIN'} - SITE ADMIN - {/if} {user.email} - + {#if user.id === data.user?.id} + {user.tenantRole === 'ADMIN' ? 'Admin' : 'Member'} + {:else} + + {/if} {formatDate(user.createdAt)} diff --git a/src/routes/api/admin/users/[userId]/+server.ts b/src/routes/api/admin/users/[userId]/+server.ts index 4ec7f56..8bff5de 100644 --- a/src/routes/api/admin/users/[userId]/+server.ts +++ b/src/routes/api/admin/users/[userId]/+server.ts @@ -22,6 +22,11 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => { }); if (!targetUser) throw error(404, 'User not found'); + // Tenant admins cannot modify SITE_ADMIN users + if (targetUser.globalRole === 'SITE_ADMIN') { + throw error(403, 'Cannot modify a site admin'); + } + // Prevent demoting the last tenant admin if (targetUser.tenantRole === 'ADMIN' && result.data.tenantRole === 'MEMBER') { const adminCount = await tx.user.count({