{"record":{"id":"cc78b7096c8d23c6","repo":"AlistGo/alist","slug":"cannot-modify-admin-role","errorCode":null,"errorMessage":"cannot modify admin role","messagePattern":"cannot modify admin role","errorType":"exception","errorClass":"ErrChangeDefaultRole","httpStatus":null,"severity":"error","filePath":"internal/errs/role.go","lineNumber":6,"sourceCode":"package errs\n\nimport \"errors\"\n\nvar (\n\tErrChangeDefaultRole = errors.New(\"cannot modify admin role\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":8,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/internal/errs/role.go#L1-L8","documentation":"ErrChangeDefaultRole ('cannot modify admin role') is a sentinel in internal/errs/role.go. The user/role management API refuses modifications that would alter the built-in admin role, because admin is the bootstrap super-user role whose identity and privileges must stay fixed.","triggerScenarios":"Calling the role update/delete endpoint with the admin role's ID; attempting to rename admin, change its permissions, or delete it via the admin role endpoints.","commonSituations":"Automation scripts iterating over all roles and blindly updating each one; UI attempts to clean up roles; attempts to demote or delete the last admin and lock everyone out. The guard exists precisely to prevent that lockout.","solutions":["Skip the built-in admin role in any batch role operations (filter by role ID/name)","Create a separate custom role with the desired permissions instead of editing admin","If different admin-level privileges are needed, assign users a new role rather than mutating admin"],"exampleFix":"// before\nfor _, r := range roles { updateRole(r) }\n\n// after\nfor _, r := range roles {\n    if r.Name == \"admin\" { continue }\n    updateRole(r)\n}","handlingStrategy":"type-guard","validationCode":"// skip the built-in admin role before role mutations\nif r.ID == 1 || r.Name == \"admin\" { // adjust to your admin-role identity\n    return errs.ErrChangeDefaultRole\n}","typeGuard":"func isAdminRole(r *model.Role) bool {\n    return r != nil && r.Name == \"admin\"\n}","tryCatchPattern":"if err := updateRole(r); err != nil {\n    if errors.Is(err, errs.ErrChangeDefaultRole) {\n        // skip: built-in admin role is immutable by design\n    }\n}","preventionTips":["Filter the admin role out of batch operations","Model extra privileges as new roles, not edits to admin","Assert role is not admin before delete/rename calls","Keep at least one admin user to avoid lockout"],"tags":["auth","role","admin","guard"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}