From: Devika Babrekar <devika.babrekar@ibm.com>
Date: Tue, 7 Jul 2026 12:13:08 +0000 (+0530)
Subject: mgr/dashboard: restricting admin user to revoke its own admin permissions
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=95a096f2c6738a0a09ca6b8ee33d11dfcd69d7ec;p=ceph.git

mgr/dashboard: restricting admin user to revoke its own admin permissions
Fixes: https://tracker.ceph.com/issues/77813

Signed-off-by: Devika Babrekar <devika.babrekar@ibm.com>

Conflicts:
	src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
-conflict while rebasing for SSO related parameters
	src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
-conflict while rebasing for SSO related variables
---

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts
index abf529196f6..fd56ec957f6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts
@@ -4,6 +4,7 @@ export class UserFormRoleModel implements SelectOption {
   name: string;
   description: string;
   selected = false;
+  disabled: boolean = false;
   scopes_permissions?: object;
   enabled: boolean;
   content: string;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
index 409b84d1f9a..bdfe497b9dd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
@@ -235,15 +235,37 @@
           [invalidText]="rolesError"
           i18n
         >
-          <cds-dropdown-list></cds-dropdown-list>
+          <cds-dropdown-list [listTpl]="roleItemTpl"></cds-dropdown-list>
         </cds-combo-box>
+
         <ng-template #rolesError>
           <span
             class="invalid-feedback"
             *ngIf="userForm.showError('roles', formDir, 'required')"
             i18n
-            >This field is required.</span
-          >
+            >This field is required.</span>
+        </ng-template>        
+        
+        <ng-template #roleItemTpl
+                    let-item="item">
+          <div class="cds--form-item cds--checkbox-wrapper">
+            <label class="cds--checkbox-label"
+                  [attr.data-contained-checkbox-disabled]="item.disabled ? 'true' : null"
+                  [attr.data-contained-checkbox-state]="item.selected ? 'true' : 'false'"
+                  [ngbTooltip]="item.disabled ? roleTooltipTpl : null">
+              <input class="cds--checkbox"
+                    type="checkbox"
+                    [checked]="item.selected"
+                    [disabled]="item.disabled"
+                    tabindex="-1"/>
+              <span class="cds--checkbox-appearance"></span>
+              <span class="cds--checkbox-label-text">{{ item.content }}</span>
+            </label>
+          </div>
+        </ng-template>
+
+        <ng-template #roleTooltipTpl>
+          <span i18n>You cannot remove the administrator role from your own account.</span>
         </ng-template>
       </div>
       <!-- Enabled -->
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
index 2f33440f2e9..f994c0b4d2e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
@@ -180,6 +180,13 @@ export class UserFormComponent extends CdForm implements OnInit {
       this.userService.get(username).subscribe((userFormModel: UserFormModel) => {
         this.response = _.cloneDeep(userFormModel);
         this.setResponse(userFormModel);
+        if (this.authStorageService.getUsername() === username) {
+          this.allRoles = _.map(this.allRoles, (role) => {
+            role.disabled =
+              role.name.toLowerCase() === 'administrator' && this.isCurrentUser() ? true : false;
+            return role;
+          });
+        }
         this.loadingReady();
       });
     });