diff --git a/api/chalicelib/core/users.py b/api/chalicelib/core/users.py index 87e87813d..a571607e8 100644 --- a/api/chalicelib/core/users.py +++ b/api/chalicelib/core/users.py @@ -107,7 +107,6 @@ def generate_new_invitation(user_id): return __get_invitation_link(cur.fetchone().pop("invitation_token")) - def reset_member(tenant_id, editor_id, user_id_to_update): admin = get(tenant_id=tenant_id, user_id=editor_id) if not admin["admin"] and not admin["superAdmin"]: @@ -282,6 +281,8 @@ def edit(user_id_to_update, tenant_id, changes, editor_id): admin = get(tenant_id=tenant_id, user_id=editor_id) if not admin["superAdmin"] and not admin["admin"]: return {"errors": ["unauthorized"]} + if user["superAdmin"]: + changes.pop("admin") keys = list(changes.keys()) for k in keys: diff --git a/ee/api/chalicelib/core/users.py b/ee/api/chalicelib/core/users.py index 7735ddca8..8bb64e26b 100644 --- a/ee/api/chalicelib/core/users.py +++ b/ee/api/chalicelib/core/users.py @@ -107,7 +107,6 @@ def generate_new_invitation(user_id): ) return __get_invitation_link(cur.fetchone().pop("invitation_token")) - def reset_member(tenant_id, editor_id, user_id_to_update): admin = get(tenant_id=tenant_id, user_id=editor_id) @@ -287,6 +286,8 @@ def edit(user_id_to_update, tenant_id, changes, editor_id): admin = get(tenant_id=tenant_id, user_id=editor_id) if not admin["superAdmin"] and not admin["admin"]: return {"errors": ["unauthorized"]} + if user["superAdmin"] and "admin" in changes: + changes.pop("admin") keys = list(changes.keys()) for k in keys: