acmucsd / membership-portal

REST API for the UC San Diego ACM chapter's membership portal.
https://members.acmucsd.com
Mozilla Public License 2.0
17 stars 5 forks source link

patch /admin/access route has no role level validation #389

Closed farisashai closed 9 months ago

farisashai commented 9 months ago

The patch route just takes a list of updates and applies them to the database - you need extra validation that admin access levels cannot be modified.

3 edge cases to take care of here

Since this is a very flexible role with full API usage, I would continue making manual DB edits to promote or demote admins which doesn't expose these edge cases to any board member with the acm portal account login credentials