From 26b8b530c9949f3b4bac32f4b1cfc0b8eb3a1182 Mon Sep 17 00:00:00 2001
From: Edouard Vanbelle <opensource@edouard.vanbelle.fr>
Date: Sun, 19 Jul 2026 16:15:54 +0200
Subject: [PATCH] security(users): prevent ext. user to become admin

---
 frontend/src/routes/admin/+page.svelte        | 30 ++++++++++++-------
 .../services/auth_application_service.rs      | 27 ++++++++++++++++-
 2 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/frontend/src/routes/admin/+page.svelte b/frontend/src/routes/admin/+page.svelte
index f2436c34..1d4a4562 100644
--- a/frontend/src/routes/admin/+page.svelte
+++ b/frontend/src/routes/admin/+page.svelte
@@ -2382,17 +2382,25 @@
 									{:else}
 										<span class="icon-btn icon-btn--placeholder" aria-hidden="true"></span>
 									{/if}
-									<!-- Slot 3: role toggle. -->
-									<button
-										class="icon-btn"
-										data-testid={`admin-user-toggle-role-${u.id}`}
-										title={t('admin.toggle_role_title', 'Toggle admin role')}
-										aria-label={t('admin.toggle_role_title', 'Toggle admin role')}
-										disabled={isSelf(u)}
-										onclick={() => toggleRole(u)}
-									>
-										<Icon name={u.role === 'admin' ? 'user' : 'crown'} />
-									</button>
+									<!-- Slot 3: role toggle. Hidden for externals — an
+									     external user cannot be admin (backend guard in
+									     `change_user_role` + DB CHECK
+									     `users_external_not_admin`). Promotion to
+									     internal is offered separately in slot 1. -->
+									{#if !u.is_external}
+										<button
+											class="icon-btn"
+											data-testid={`admin-user-toggle-role-${u.id}`}
+											title={t('admin.toggle_role_title', 'Toggle admin role')}
+											aria-label={t('admin.toggle_role_title', 'Toggle admin role')}
+											disabled={isSelf(u)}
+											onclick={() => toggleRole(u)}
+										>
+											<Icon name={u.role === 'admin' ? 'user' : 'crown'} />
+										</button>
+									{:else}
+										<span class="icon-btn icon-btn--placeholder" aria-hidden="true"></span>
+									{/if}
 									<!-- Slot 4: activate/deactivate. -->
 									<button
 										class="icon-btn {u.active ? 'icon-btn--danger' : 'icon-btn--success'}"
diff --git a/src/application/services/auth_application_service.rs b/src/application/services/auth_application_service.rs
index ce498dff..373d8810 100644
--- a/src/application/services/auth_application_service.rs
+++ b/src/application/services/auth_application_service.rs
@@ -2434,7 +2434,13 @@ impl AuthApplicationService {
         Ok(())
     }
 
-    /// Change user role (admin only)
+    /// Change user role (admin only).
+    ///
+    /// Refuses `role = "admin"` when the target is external (grant-only).
+    /// The DB CHECK `users_external_not_admin` would also refuse this at
+    /// COMMIT, but surfacing it here yields a clean `InvalidInput` error
+    /// with an audit line naming the reason, instead of a bare
+    /// constraint-violation stringified out of Postgres.
     pub async fn change_user_role(&self, user_id: Uuid, role: &str) -> Result<(), DomainError> {
         if role != "admin" && role != "user" {
             return Err(DomainError::new(
@@ -2443,6 +2449,25 @@ impl AuthApplicationService {
                 format!("Invalid role: {}. Must be 'admin' or 'user'", role),
             ));
         }
+
+        if role == "admin" {
+            let target = self.user_storage.get_user_by_id(user_id).await?;
+            if target.is_external() {
+                tracing::info!(
+                    target: "audit",
+                    event = "user.role_change_rejected",
+                    reason = "external_cannot_be_admin",
+                    target_id = %user_id,
+                    "👮🏻‍♂️ role change refused: external users cannot hold the admin role",
+                );
+                return Err(DomainError::new(
+                    ErrorKind::InvalidInput,
+                    "User",
+                    "External accounts cannot hold the admin role. Promote the user to internal first.",
+                ));
+            }
+        }
+
         self.user_storage.change_role(user_id, role).await?;
         self.user_flags_cache.invalidate(&user_id).await;
         Ok(())