monicahq/monica · error · Exception

You cannot remove your own administrator privilege.

Error message

You cannot remove your own administrator privilege.

What it means

RemoveAdministratorPrivilege strips is_account_administrator from another user. To prevent administrators from locking themselves (and potentially the whole account) out of administration, the service refuses when the target user id equals the acting author's id, throwing \Exception (rendered as a 500).

Source

Thrown at app/Domains/Settings/ManageUsers/Services/RemoveAdministratorPrivilege.php:46

        return [
            'author_must_belong_to_account',
            'author_must_be_account_administrator',
        ];
    }

    /**
     * Remove the administrator permission from another user.
     */
    public function execute(array $data): User
    {
        $this->validateRules($data);

        /** @var User */
        $user = $this->account()->users()
            ->findOrFail($data['user_id']);

        if ($user->id === $this->author->id) {
            throw new \Exception(trans('You cannot remove your own administrator privilege.'));
        }

        $user->is_account_administrator = false;
        $user->save();

        return $user;
    }
}

View on GitHub (pinned to e08e917341)

Solutions

1. Target another administrator's user_id
2. Filter the current user out of the eligible list in the UI
3. Ensure at least one other administrator exists before demoting anyone
4. Validate user_id !== author_id at the call site before invoking the service

// Validate before calling: the target must not be the acting author
if ($data['user_id'] === (string) $author->id) {
    throw ValidationException::withMessages([
        'user_id' => 'You cannot remove your own administrator privilege.',
    ]);
}

function isSelfDemotionAttempt(string $targetUserId, User $author): bool
{
    return $targetUserId === (string) $author->id;
}

try {
    app(RemoveAdministratorPrivilege::class)->execute($data);
} catch (\Exception $e) {
    if (str_contains($e->getMessage(), 'own administrator privilege')) {
        throw ValidationException::withMessages(['user_id' => $e->getMessage()]);
    }
    throw $e;
}

When it happens

Trigger: Posting remove-administrator-privilege with your own user_id — e.g. a UI that lists every account user including the current one, or a caller that copies author_id into user_id.

Common situations: Frontend not filtering the current user out of the target list, scripts passing author_id as user_id, or id mix-ups between the two payload fields.

Related errors

• You can't delete yourself.
• Could not get address book data.
• No address book found
• $e->getMessage()
• The user does not belong to the vault's account.

AI-assisted analysis of monicahq/monica@e08e917341 (2026-08-17). Data as JSON: /api/errors/80f25d2af5c893b5. Report an issue: GitHub.