Skip to content

fix(auth): reject admin registration role#4121

Open
luresun1988-bot wants to merge 1 commit into
SecureBananaLabs:mainfrom
luresun1988-bot:fix-register-public-roles
Open

fix(auth): reject admin registration role#4121
luresun1988-bot wants to merge 1 commit into
SecureBananaLabs:mainfrom
luresun1988-bot:fix-register-public-roles

Conversation

@luresun1988-bot

Copy link
Copy Markdown

Summary

  • Restrict public registration roles to client and freelancer
  • Reject admin role self-assignment at the registration schema boundary
  • Add validator coverage for rejected admin, accepted public roles, and the default client role

Tests

  • node --test src/tests/*.test.js from apps/api

Fixes #4120

github-actions Bot added a commit that referenced this pull request Jun 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prevent admin role self-assignment during registration (reissue via #743)

1 participant