fix(admin): protect administrator access

Reject final-admin demotion and deletion at the API boundary. Require explicit confirmation before any administrator role removal.

job-tracker-ui/src/views/AdminUsersPage.tsx

@@ -1,6 +1,7 @@
 import React, { useCallback, useEffect, useMemo, useState } from "react";
 
 import {
+  Alert,
   Box,
   Button,
   Checkbox,
@@ -9,6 +10,7 @@ import {
   Paper,
   Stack,
   TextField,
+  Tooltip,
   Typography,
 } from "@mui/material";
 import useMediaQuery from "@mui/material/useMediaQuery";
@@ -25,6 +27,8 @@ type UserDto = {
   userName?: string | null;
   emailConfirmed: boolean;
   roles: string[];
+  isCurrentUser: boolean;
+  canRemoveAdmin: boolean;
 };
 
 export default function AdminUsersPage() {
@@ -66,16 +70,33 @@ export default function AdminUsersPage() {
     raw: u,
   })), [users]);
 
-  const setAdminRole = useCallback(async (u: UserDto, isAdmin: boolean) => {
+  const setAdminRole = useCallback(async (u: UserDto, grantAdmin: boolean) => {
+    if (!grantAdmin) {
+      const name = u.userName || u.email || u.id;
+      const confirmed = await confirmAction(
+        u.isCurrentUser
+          ? t("adminUsersSelfDemoteWarning")
+          : t("adminUsersDemoteWarning", { name }),
+        {
+          title: u.isCurrentUser ? t("adminUsersSelfDemoteTitle") : t("adminUsersDemoteTitle"),
+          confirmLabel: t("adminUsersRemoveAdmin"),
+          destructive: true,
+        },
+      );
+      if (!confirmed) return;
+    }
+
     try {
-      await api.put(`/users/${u.id}/roles`, { roles: isAdmin ? ["Admin"] : [] });
+      const roles = grantAdmin
+        ? Array.from(new Set([...(u.roles || []), "Admin"]))
+        : (u.roles || []).filter((role) => role.toLowerCase() !== "admin");
+      await api.put(`/users/${u.id}/roles`, { roles });
       toast(t("adminUsersRolesUpdated"), "success");
       await load();
-    } catch (e: any) {
-      const msg = e?.response?.data || e?.message || t("adminUsersRolesUpdateFailed");
-      toast(String(msg), "error");
+    } catch (e) {
+      toast(getApiErrorMessage(e, t("adminUsersRolesUpdateFailed")), "error");
     }
-  }, [t, toast]);
+  }, [confirmAction, t, toast]);
 
   const sendReset = useCallback(async (u: UserDto) => {
     try {
@@ -88,18 +109,32 @@ export default function AdminUsersPage() {
 
   const remove = useCallback(async (u: UserDto) => {
     const name = u.userName || u.email || u.id;
-    if (!(await confirmAction(t("adminUsersDeleteConfirmNamed", { name }), { title: t("adminUsersDeleteConfirmTitle"), confirmLabel: t("adminUsersDelete"), destructive: true }))) return;
+    const message = u.isCurrentUser
+      ? t("adminUsersDeleteSelfWarning")
+      : t("adminUsersDeleteConfirmNamed", { name });
+    if (!(await confirmAction(message, { title: t("adminUsersDeleteConfirmTitle"), confirmLabel: t("adminUsersDelete"), destructive: true }))) return;
     try {
       await api.delete(`/users/${u.id}`);
       toast(t("adminUsersDeleted"), "info");
       await load();
-    } catch {
-      toast(t("adminUsersDeleteFailed"), "error");
+    } catch (e) {
+      toast(getApiErrorMessage(e, t("adminUsersDeleteFailed")), "error");
     }
   }, [confirmAction, t, toast]);
 
   const columns = useMemo<GridColDef[]>(() => [
-    { field: "email", headerName: t("profileEmail"), flex: 1.2, minWidth: 220 },
+    {
+      field: "email",
+      headerName: t("profileEmail"),
+      flex: 1.2,
+      minWidth: 220,
+      renderCell: (params) => (
+        <Box sx={{ display: "flex", alignItems: "center", gap: 0.75, minWidth: 0 }}>
+          <Typography variant="body2" noWrap>{params.value}</Typography>
+          {(params.row.raw as UserDto).isCurrentUser ? <Chip size="small" label={t("adminUsersYou")} color="primary" variant="outlined" /> : null}
+        </Box>
+      ),
+    },
     { field: "userName", headerName: t("profileUsername"), flex: 1, minWidth: 180 },
     {
       field: "roles",
@@ -136,15 +171,19 @@ export default function AdminUsersPage() {
         const isAdmin = (user.roles || []).includes("Admin");
         return (
           <Box sx={{ display: "flex", gap: 1, flexWrap: "wrap", py: 0.5 }}>
-            <Button size="small" variant={isAdmin ? "contained" : "outlined"} onClick={() => void setAdminRole(user, !isAdmin)}>
-              {t("adminUsersAdmin")}
-            </Button>
+            <Tooltip title={isAdmin && !user.canRemoveAdmin ? t("adminUsersLastAdminHelp") : ""}>
+              <span>
+                <Button size="small" variant={isAdmin ? "contained" : "outlined"} disabled={isAdmin && !user.canRemoveAdmin} onClick={() => void setAdminRole(user, !isAdmin)}>
+                  {isAdmin ? t("adminUsersRemoveAdmin") : t("adminUsersMakeAdmin")}
+                </Button>
+              </span>
+            </Tooltip>
             <Button size="small" variant="outlined" onClick={() => void sendReset(user)}>
               {t("adminUsersSendReset")}
             </Button>
-            <Button size="small" color="error" variant="outlined" onClick={() => void remove(user)}>
-              {t("adminUsersDelete")}
-            </Button>
+            <Tooltip title={isAdmin && !user.canRemoveAdmin ? t("adminUsersLastAdminHelp") : ""}>
+              <span><Button size="small" color="error" variant="outlined" disabled={isAdmin && !user.canRemoveAdmin} onClick={() => void remove(user)}>{t("adminUsersDelete")}</Button></span>
+            </Tooltip>
           </Box>
         );
       },
@@ -157,6 +196,7 @@ export default function AdminUsersPage() {
         {t("adminUsersTitle")}
       </Typography>
       <Typography sx={{ color: "text.secondary", mb: 2 }}>{t("adminUsersSubtitle")}</Typography>
+      <Alert severity="info" sx={{ mb: 2 }}>{t("adminUsersSafetyNotice")}</Alert>
 
       <Paper sx={{ p: { xs: 1.5, sm: 2 }, mb: 2 }}>
         <Typography sx={{ fontWeight: 900, mb: 1 }}>{t("adminUsersCreateUser")}</Typography>
@@ -201,9 +241,10 @@ export default function AdminUsersPage() {
               <Paper key={row.id} sx={{ p: 1.5, borderRadius: 3 }}>
                 <Stack spacing={1.25}>
                   <Box>
-                    <Typography sx={{ fontWeight: 900, overflowWrap: "anywhere" }}>
-                      {row.userName || row.email || row.id}
-                    </Typography>
+                    <Box sx={{ display: "flex", alignItems: "center", gap: 1, flexWrap: "wrap" }}>
+                      <Typography component="span" sx={{ fontWeight: 900, overflowWrap: "anywhere" }}>{row.userName || row.email || row.id}</Typography>
+                      {user.isCurrentUser ? <Chip size="small" label={t("adminUsersYou")} color="primary" variant="outlined" /> : null}
+                    </Box>
                     <Typography variant="body2" sx={{ color: "text.secondary", overflowWrap: "anywhere" }}>
                       {row.email || "—"}
                     </Typography>
@@ -217,15 +258,15 @@ export default function AdminUsersPage() {
                   </Box>
 
                   <Stack spacing={1}>
-                    <Button variant={isAdmin ? "contained" : "outlined"} onClick={() => void setAdminRole(user, !isAdmin)} fullWidth>
-                      {t("adminUsersAdmin")}
-                    </Button>
+                    <Tooltip title={isAdmin && !user.canRemoveAdmin ? t("adminUsersLastAdminHelp") : ""}>
+                      <span><Button variant={isAdmin ? "contained" : "outlined"} disabled={isAdmin && !user.canRemoveAdmin} onClick={() => void setAdminRole(user, !isAdmin)} fullWidth>{isAdmin ? t("adminUsersRemoveAdmin") : t("adminUsersMakeAdmin")}</Button></span>
+                    </Tooltip>
                     <Button variant="outlined" onClick={() => void sendReset(user)} fullWidth>
                       {t("adminUsersSendReset")}
                     </Button>
-                    <Button color="error" variant="outlined" onClick={() => void remove(user)} fullWidth>
-                      {t("adminUsersDelete")}
-                    </Button>
+                    <Tooltip title={isAdmin && !user.canRemoveAdmin ? t("adminUsersLastAdminHelp") : ""}>
+                      <span><Button color="error" variant="outlined" disabled={isAdmin && !user.canRemoveAdmin} onClick={() => void remove(user)} fullWidth>{t("adminUsersDelete")}</Button></span>
+                    </Tooltip>
                   </Stack>
                 </Stack>
               </Paper>