{"record":{"id":"e241db1715017c08","repo":"forem/forem","slug":"you-need-super-admin-status-to-take-this-action","errorCode":null,"errorMessage":"You need super admin status to take this action","messagePattern":"You need super admin status to take this action","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"app/services/moderator/manage_activity_and_roles.rb","lineNumber":135,"sourceCode":"\n      user.articles.published.find_each(&:async_score_calc)\n      user.comments.find_each(&:calculate_score)\n    end\n    # rubocop:enable Metrics/CyclomaticComplexity\n\n    def assign_elevated_role_to_user(user, role)\n      check_super_admin\n      remove_negative_roles\n      user.add_role(role)\n\n      # Clear cache key if the elevated role matches Rack::Attack bypass roles\n      return unless Rack::Attack::ADMIN_ROLES.include?(role.to_s)\n\n      Rails.cache.delete(Rack::Attack::ADMIN_API_CACHE_KEY)\n    end\n\n    def check_super_admin\n      raise I18n.t(\"services.moderator.manage_activity_and_roles.need_super\") unless @admin.super_admin?\n    end\n\n    def assign_community_leader_role(role)\n      remove_negative_roles\n      CommunityLeaders::Add.call(user, role)\n    end\n\n    def comment_suspended\n      user.add_role(:comment_suspended)\n      user.remove_role(:suspended)\n      remove_privileges\n    end\n\n    def limited\n      user.add_role(:limited)\n      remove_privileges\n    end\n","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/forem/forem/blob/f354c376a7c5d1330dc40d66f150be8d1289020d/app/services/moderator/manage_activity_and_roles.rb#L117-L153","documentation":"Raised by Moderator::ManageActivityAndRoles#check_super_admin when an elevated-role assignment (via assign_elevated_role_to_user) is attempted by an admin who lacks the super_admin flag. Forem reserves granting roles like admin, super_admin, moderator, etc. for super admins only; a plain admin driving this service gets the I18n 'need_super' error before any role changes.","triggerScenarios":"A non-super-admin admin uses the admin user-management flow to promote someone to an elevated role; scripts/seeds instantiate Moderator::ManageActivityAndRoles with a regular :admin actor; specs create the actor with create(:admin) instead of the super_admin trait.","commonSituations":"Newly promoted admins discovering role-granting limits; automation running under a service account that only has :admin; test suites failing after authorization was tightened; console maintenance done while signed in as the wrong admin.","solutions":["Have an existing super admin perform the role change, or grant the actor super_admin first","In specs, build the actor with create(:user, :super_admin) so check_super_admin passes","For scripts, resolve a designated super admin: User.with_role(:super_admin).first","Verify the actor with actor.has_role?(:super_admin) before invoking the service"],"exampleFix":"# before\nadmin = User.find_by(username: 'helper_admin') # plain admin\nModerator::ManageActivityAndRoles.new(admin: admin, user: user, user_params: {}).handle_user_status('Admin', nil)\n\n# after\nadmin = User.with_role(:super_admin).first # or create(:user, :super_admin) in specs\nModerator::ManageActivityAndRoles.new(admin: admin, user: user, user_params: {}).handle_user_status('Admin', nil)","handlingStrategy":"validation","validationCode":"# Guard the actor before touching the service\nraise ArgumentError, 'actor must be a super admin' unless actor.has_role?(:super_admin)\n\nModerator::ManageActivityAndRoles.new(admin: actor, user: target, user_params: {}).handle_user_status(status, nil)","typeGuard":"# Ruby predicate narrowing\ndef super_admin?(user)\n  user.has_role?(:super_admin)\nend\n\nhandle_user_status(...) if super_admin?(actor)","tryCatchPattern":"begin\n  Moderator::ManageActivityAndRoles.new(admin: admin, user: user, user_params: {}).handle_user_status(status, nil)\nrescue StandardError => e\n  return render json: { error: e.message }, status: :forbidden if e.message.include?('super admin')\n  raise\nend","preventionTips":["Only render elevated-role actions in the admin UI when current_user.super_admin? is true","Use the :super_admin factory trait in every spec that changes elevated roles","Run automated role scripts as a designated super-admin service account","Check actor.has_role?(:super_admin) at the entry point, not deep in the service"],"tags":["ruby","rails","authorization","roles","admin","moderation"],"backgroundTag":"insufficient-permissions","analyzedSha":"f354c376a7c5d1330dc40d66f150be8d1289020d","analyzedAt":"2026-08-21T12:43:44.428Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}