mrhid6/vantage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity

feat(server): refuse local edits to hq-sourced users

Browse Source 
The API is the boundary; hiding the control in web/ is a courtesy. A role
editable in two places is a role with two answers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mrhid6
2026-07-26 16:31:27 +01:00
co-authored by Claude Opus 5
parent 14b855fa9f
commit a05a74cf4d
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/api/instance.go
+3 -1
View File
@@ -111,7 +111,9 @@ func deleteInstanceUser(c *gin.Context) {
}
func orgUserErrStatus(err error) int {
if errors.Is(err, services.ErrLastOwner) {
// 409 rather than 403: the caller has the right to manage members, and the
// request is refused because of the resource's state, not their permissions.
if errors.Is(err, services.ErrLastOwner) || errors.Is(err, services.ErrHQManaged) {
return http.StatusConflict
}
return http.StatusInternalServerError