fix: prevent users from self-escalate to owners

Block non-owners from changing owner status

Return 403 in the logged-account update handler when a non-owner
submits the owner field, and add a regression test to ensure regular
users cannot self-escalate privileges.

Fixes #1196

Author: fmartingr

internal/http/handlers/api/v1/auth.go

@@ -177,6 +177,14 @@ func HandleUpdateLoggedAccount(deps model.Dependencies, c model.WebContext) {
 
 	account := c.GetAccount()
 
+	// Only owners are allowed to change the owner flag. Without this check any
+	// authenticated user could escalate their own privileges to administrator
+	// through this self-service endpoint.
+	if payload.Owner != nil && !account.IsOwner() {
+		response.SendError(c, http.StatusForbidden, "Only owners can change the owner status")
+		return
+	}
+
 	if payload.NewPassword != "" {
 		_, err := deps.Domains().Auth().GetAccountFromCredentials(c.Request().Context(), account.Username, payload.OldPassword)
 		if err != nil {

internal/http/handlers/api/v1/auth_test.go

@@ -195,6 +195,23 @@ func TestHandleUpdateLoggedAccount(t *testing.T) {
 		require.Equal(t, http.StatusBadRequest, w.Code)
 	})
 
+	t.Run("non-owner cannot escalate to owner", func(t *testing.T) {
+		regularAccount, err := deps.Domains().Accounts().CreateAccount(context.Background(), model.AccountDTO{
+			Username: "regular",
+			Password: "gopher",
+			Owner:    model.Ptr(false),
+		})
+		require.NoError(t, err)
+
+		body := `{"owner": true}`
+		w := testutil.PerformRequest(deps, HandleUpdateLoggedAccount, "PATCH", "/account", testutil.WithBody(body), testutil.WithAccount(regularAccount))
+		require.Equal(t, http.StatusForbidden, w.Code)
+
+		stored, err := deps.Domains().Accounts().GetAccountByUsername(context.Background(), "regular")
+		require.NoError(t, err)
+		require.False(t, stored.IsOwner())
+	})
+
 	t.Run("successful update", func(t *testing.T) {
 		body := `{
 			"old_password": "gopher",