v0.11.26 new rules for default admin user

2026-03-22 18:51:46 -04:00
parent 25a9fa4a02
commit 21dc788cd3
8 changed files with 42 additions and 15 deletions
--- a/backend/src/routes/users.js
+++ b/backend/src/routes/users.js
@@ -281,6 +281,7 @@ router.patch('/me/profile', authMiddleware, async (req, res) => {

 // Upload avatar
 router.post('/me/avatar', authMiddleware, uploadAvatar.single('avatar'), async (req, res) => {
+  if (req.user.is_default_admin) return res.status(403).json({ error: 'Default admin avatar cannot be changed' });
  if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
  try {
    const sharp    = require('sharp');