From 974062f16169f6d07f2289564be6d72610b8770e Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Tue, 4 Aug 2026 05:40:54 +0200
Subject: Witness every promotion and demotion made through the roles form

---
 app/models/user.rb | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

(limited to 'app/models/user.rb')

diff --git a/app/models/user.rb b/app/models/user.rb
index adfdc564..786f8d14 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -132,6 +132,7 @@ class User < ApplicationRecord
 
   def deactivate!(actor:)
     return false if alumni?
+    return false if actor == self
     transaction do
       update_column(:roles, (roles | ["alumni"]).sort)
       NodeAction.record!(:participants => [self], :user => actor,
@@ -174,6 +175,56 @@ class User < ApplicationRecord
     :revoked
   end
 
+  def grant_admin!(actor:)
+    return :already if is_admin?
+    return :no_second_factor unless otp_enrolled?
+
+    transaction do
+      update_column(:roles, (roles | ["admin"]).sort)
+      NodeAction.record!(:participants => [self], :user => actor,
+                          :action => "admin_grant", :target_login => login)
+    end
+    :granted
+  end
+
+  def revoke_admin!(actor:)
+    return :already unless is_admin?
+    return :self unless actor != self
+
+    transaction do
+      update_column(:roles, (roles - ["admin"]).sort)
+      NodeAction.record!(:participants => [self], :user => actor,
+                          :action => "admin_revoke", :target_login => login)
+    end
+    :revoked
+  end
+
+  def update_roles!(desired, actor:)
+    desired = Array(desired).map(&:to_s) & ROLES
+    refusals = []
+
+    transaction do
+      refusals << :admin_not_self         if is_admin?  && !desired.include?("admin")     && actor == self
+      refusals << :redaktion_not_self     if redaktion? && !desired.include?("redaktion") && actor == self
+      refusals << :cannot_deactivate_self if !alumni?   &&  desired.include?("alumni")    && actor == self
+      refusals << :admin_needs_otp        if !is_admin?  && desired.include?("admin")     && !otp_enrolled?
+      refusals << :redaktion_needs_otp    if !redaktion? && desired.include?("redaktion") && !otp_enrolled?
+
+      raise ActiveRecord::Rollback if refusals.any?
+
+      revoke_admin!(:actor => actor)     if is_admin?   && !desired.include?("admin")
+      revoke_redaktion!(:actor => actor) if redaktion?  && !desired.include?("redaktion")
+      reactivate!(:actor => actor)       if alumni?     && !desired.include?("alumni")
+
+      grant_admin!(:actor => actor)     if !is_admin?  && desired.include?("admin")
+      grant_redaktion!(:actor => actor) if !redaktion? && desired.include?("redaktion")
+
+      deactivate!(:actor => actor) if !alumni? && desired.include?("alumni")
+    end
+
+    refusals
+  end
+
   # otp_secret present == enrolled. otp_pending_secret holds the secret
   # between QR display and first-code confirmation. otp_consumed_timestep
   # makes every accepted code single-use (replay guard within the drift
-- 
cgit v1.3