diff --git a/admin.py b/admin.py index 445cfaa..b72d615 100644 --- a/admin.py +++ b/admin.py @@ -126,11 +126,13 @@ def register_admin_routes(app): # Update user in Firestore user_ref = db.collection("users").document(target_uid) - user_ref.update({ + # Only update fields that can be changed, excluding is_admin + update_data = { "enabled": data.get("enabled", False), - "is_admin": data.get("is_admin", False), "case_email": data.get("case_email", "") - }) + } + # Never allow changing is_admin field during updates - admin status can only be set during creation + user_ref.update(update_data) return jsonify({"success": True}) diff --git a/templates/admin_user_edit.html b/templates/admin_user_edit.html index 6f74980..3a4ef16 100644 --- a/templates/admin_user_edit.html +++ b/templates/admin_user_edit.html @@ -26,11 +26,15 @@
-
+ {% if not user.is_admin %} +

Admin status can only be set during user creation.

+ {% endif %}
@@ -62,7 +66,6 @@ document.getElementById('userForm').addEventListener('submit', function(e) { const userData = { uid: '{{ user.uid }}', enabled: formData.get('enabled') === 'on', - is_admin: formData.get('is_admin') === 'on', case_email: formData.get('case_email') }; diff --git a/templates/login.html b/templates/login.html index ce22f57..3cfa0cd 100644 --- a/templates/login.html +++ b/templates/login.html @@ -4,6 +4,9 @@

Secure Access

+
+

If you don't have a user account, or need to reset your password, send an email to office@rothbardlawgroup.com.

+