forem/forem · error · RuntimeError

You need super admin status to take this action

Error message

You need super admin status to take this action

What it means

Raised by Moderator::ManageActivityAndRoles#check_super_admin when an elevated-role assignment (via assign_elevated_role_to_user) is attempted by an admin who lacks the super_admin flag. Forem reserves granting roles like admin, super_admin, moderator, etc. for super admins only; a plain admin driving this service gets the I18n 'need_super' error before any role changes.

Source

Thrown at app/services/moderator/manage_activity_and_roles.rb:135

      user.articles.published.find_each(&:async_score_calc)
      user.comments.find_each(&:calculate_score)
    end
    # rubocop:enable Metrics/CyclomaticComplexity

    def assign_elevated_role_to_user(user, role)
      check_super_admin
      remove_negative_roles
      user.add_role(role)

      # Clear cache key if the elevated role matches Rack::Attack bypass roles
      return unless Rack::Attack::ADMIN_ROLES.include?(role.to_s)

      Rails.cache.delete(Rack::Attack::ADMIN_API_CACHE_KEY)
    end

    def check_super_admin
      raise I18n.t("services.moderator.manage_activity_and_roles.need_super") unless @admin.super_admin?
    end

    def assign_community_leader_role(role)
      remove_negative_roles
      CommunityLeaders::Add.call(user, role)
    end

    def comment_suspended
      user.add_role(:comment_suspended)
      user.remove_role(:suspended)
      remove_privileges
    end

    def limited
      user.add_role(:limited)
      remove_privileges
    end

View on GitHub (pinned to f354c376a7)

Solutions

1. Have an existing super admin perform the role change, or grant the actor super_admin first
2. In specs, build the actor with create(:user, :super_admin) so check_super_admin passes
3. For scripts, resolve a designated super admin: User.with_role(:super_admin).first
4. Verify the actor with actor.has_role?(:super_admin) before invoking the service

Example fix

# before
admin = User.find_by(username: 'helper_admin') # plain admin
Moderator::ManageActivityAndRoles.new(admin: admin, user: user, user_params: {}).handle_user_status('Admin', nil)

# after
admin = User.with_role(:super_admin).first # or create(:user, :super_admin) in specs
Moderator::ManageActivityAndRoles.new(admin: admin, user: user, user_params: {}).handle_user_status('Admin', nil)

# Guard the actor before touching the service
raise ArgumentError, 'actor must be a super admin' unless actor.has_role?(:super_admin)

Moderator::ManageActivityAndRoles.new(admin: actor, user: target, user_params: {}).handle_user_status(status, nil)

# Ruby predicate narrowing
def super_admin?(user)
  user.has_role?(:super_admin)
end

handle_user_status(...) if super_admin?(actor)

begin
  Moderator::ManageActivityAndRoles.new(admin: admin, user: user, user_params: {}).handle_user_status(status, nil)
rescue StandardError => e
  return render json: { error: e.message }, status: :forbidden if e.message.include?('super admin')
  raise
end

When it happens

Trigger: A non-super-admin admin uses the admin user-management flow to promote someone to an elevated role; scripts/seeds instantiate Moderator::ManageActivityAndRoles with a regular :admin actor; specs create the actor with create(:admin) instead of the super_admin trait.

Common situations: Newly promoted admins discovering role-granting limits; automation running under a service account that only has :admin; test suites failing after authorization was tightened; console maintenance done while signed in as the wrong admin.

Related errors

• Please choose a role to add.
• Please choose a badge to award
• Unable to process #{params[:role]}
• Not Found
• Routing Error

AI-assisted analysis of forem/forem@f354c376a7 (2026-08-21). Data as JSON: /api/errors/e241db1715017c08. Report an issue: GitHub.