{"record":{"id":"80f25d2af5c893b5","repo":"monicahq/monica","slug":"you-cannot-remove-your-own-administrator-privilege","errorCode":null,"errorMessage":"You cannot remove your own administrator privilege.","messagePattern":"You cannot remove your own administrator privilege\\.","errorType":"exception","errorClass":"Exception","httpStatus":500,"severity":"error","filePath":"app/Domains/Settings/ManageUsers/Services/RemoveAdministratorPrivilege.php","lineNumber":46,"sourceCode":"        return [\n            'author_must_belong_to_account',\n            'author_must_be_account_administrator',\n        ];\n    }\n\n    /**\n     * Remove the administrator permission from another user.\n     */\n    public function execute(array $data): User\n    {\n        $this->validateRules($data);\n\n        /** @var User */\n        $user = $this->account()->users()\n            ->findOrFail($data['user_id']);\n\n        if ($user->id === $this->author->id) {\n            throw new \\Exception(trans('You cannot remove your own administrator privilege.'));\n        }\n\n        $user->is_account_administrator = false;\n        $user->save();\n\n        return $user;\n    }\n}\n","sourceCodeStart":28,"sourceCodeEnd":55,"githubUrl":"https://github.com/monicahq/monica/blob/e08e91734170b6bbd582cb578532c3948196124e/app/Domains/Settings/ManageUsers/Services/RemoveAdministratorPrivilege.php#L28-L55","documentation":"RemoveAdministratorPrivilege strips is_account_administrator from another user. To prevent administrators from locking themselves (and potentially the whole account) out of administration, the service refuses when the target user id equals the acting author's id, throwing \\Exception (rendered as a 500).","triggerScenarios":"Posting remove-administrator-privilege with your own user_id — e.g. a UI that lists every account user including the current one, or a caller that copies author_id into user_id.","commonSituations":"Frontend not filtering the current user out of the target list, scripts passing author_id as user_id, or id mix-ups between the two payload fields.","solutions":["Target another administrator's user_id","Filter the current user out of the eligible list in the UI","Ensure at least one other administrator exists before demoting anyone","Validate user_id !== author_id at the call site before invoking the service"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate before calling: the target must not be the acting author\nif ($data['user_id'] === (string) $author->id) {\n    throw ValidationException::withMessages([\n        'user_id' => 'You cannot remove your own administrator privilege.',\n    ]);\n}","typeGuard":"function isSelfDemotionAttempt(string $targetUserId, User $author): bool\n{\n    return $targetUserId === (string) $author->id;\n}","tryCatchPattern":"try {\n    app(RemoveAdministratorPrivilege::class)->execute($data);\n} catch (\\Exception $e) {\n    if (str_contains($e->getMessage(), 'own administrator privilege')) {\n        throw ValidationException::withMessages(['user_id' => $e->getMessage()]);\n    }\n    throw $e;\n}","preventionTips":["Filter the current user out of the demotion list in the UI","Compare the target id against the authenticated user before submitting","Ensure another administrator exists before demoting anyone","Pass author_id server-side from the session, never from client input"],"tags":["monica","users","administrator","self-guard"],"backgroundTag":"self-operation-forbidden","analyzedSha":"e08e91734170b6bbd582cb578532c3948196124e","analyzedAt":"2026-08-17T01:36:49.014Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}