Members holding the Administrator role can edit its rights

Shipped

October 28, 2026 at 2:57 AM UTC

Author

Kamo

Commit

1bfc50b

PUT /api/security/roles/{id} routes the Administrator role's rights through **************** BEFORE any other write so a refused save writes nothing. Only a caller who holds that role (or has an open god window) may; CONFIGURE_SYSTEM alone is not enough. A save that would switch off CONFIGURE_SYSTEM is a 400 with a plain reason. The role reads carry lockedRights for such a caller. Security models on the role stay locked.