From f2c1f7e02d9ef7351482d4d4dcc94e142928100f Mon Sep 17 00:00:00 2001
From: Andrey Smakotin <slamfromm@gmail.com>
Date: Mon, 1 Dec 2025 23:06:54 +0300
Subject: [PATCH] feat: add self-modification protection for user roles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Protect owners from accidentally locking themselves out by:
- Adding RoleService.can_modify_user_role() to centralize validation logic
- Blocking edit/delete operations on own role in views
- Hiding edit/delete buttons for own role in template

This prevents owners from:
- Changing their own role to a lower privilege level
- Deactivating themselves
- Deleting their own access

Standard admin pattern used by GitHub, WordPress, Django Admin.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 myproject/user_roles/services.py              | 22 +++++++++++++++++++
 .../templates/user_roles/user_role_list.html  | 18 ++++++++++-----
 myproject/user_roles/views.py                 | 12 ++++++++++
 3 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/myproject/user_roles/services.py b/myproject/user_roles/services.py
index 3f77b23..014a6ec 100644
--- a/myproject/user_roles/services.py
+++ b/myproject/user_roles/services.py
@@ -98,3 +98,25 @@ class RoleService:
         if not user_role:
             return False
         return user_role.code in role_codes
+
+    @staticmethod
+    def can_modify_user_role(modifier_user, target_user_role):
+        """
+        Проверяет, может ли пользователь изменить указанную роль.
+
+        Args:
+            modifier_user: Пользователь, который хочет изменить роль
+            target_user_role: UserRole объект, который нужно изменить
+
+        Returns:
+            tuple: (bool, str) - (можно ли изменить, причина отказа)
+        """
+        # Защита от самоблокировки
+        if target_user_role.user == modifier_user:
+            return False, "Вы не можете изменить свою собственную роль"
+
+        # Можно добавить другие проверки в будущем:
+        # - Запрет удаления последнего owner'а
+        # - Проверка иерархии ролей и т.д.
+
+        return True, ""
diff --git a/myproject/user_roles/templates/user_roles/user_role_list.html b/myproject/user_roles/templates/user_roles/user_role_list.html
index 710f8c6..8ce4671 100644
--- a/myproject/user_roles/templates/user_roles/user_role_list.html
+++ b/myproject/user_roles/templates/user_roles/user_role_list.html
@@ -67,12 +67,18 @@
                                     {% endif %}
                                 </td>
                                 <td>
-                                    <a href="{% url 'user_roles:edit' user_role.pk %}" class="btn btn-sm btn-outline-primary">
-                                        <i class="bi bi-pencil"></i> Изменить
-                                    </a>
-                                    <a href="{% url 'user_roles:delete' user_role.pk %}" class="btn btn-sm btn-outline-danger">
-                                        <i class="bi bi-trash"></i> Удалить
-                                    </a>
+                                    {% if user_role.user != request.user %}
+                                        <a href="{% url 'user_roles:edit' user_role.pk %}" class="btn btn-sm btn-outline-primary">
+                                            <i class="bi bi-pencil"></i> Изменить
+                                        </a>
+                                        <a href="{% url 'user_roles:delete' user_role.pk %}" class="btn btn-sm btn-outline-danger">
+                                            <i class="bi bi-trash"></i> Удалить
+                                        </a>
+                                    {% else %}
+                                        <span class="text-muted small">
+                                            <i class="bi bi-lock"></i> Ваша роль
+                                        </span>
+                                    {% endif %}
                                 </td>
                             </tr>
                             {% endfor %}
diff --git a/myproject/user_roles/views.py b/myproject/user_roles/views.py
index 28148fc..4759006 100644
--- a/myproject/user_roles/views.py
+++ b/myproject/user_roles/views.py
@@ -64,6 +64,12 @@ def user_role_edit(request, pk):
     """Изменение роли пользователя"""
     user_role = get_object_or_404(UserRole, pk=pk)
 
+    # Защита от самоблокировки
+    can_modify, error_message = RoleService.can_modify_user_role(request.user, user_role)
+    if not can_modify:
+        messages.error(request, error_message)
+        return redirect('user_roles:list')
+
     if request.method == 'POST':
         role_code = request.POST.get('role')
         is_active = request.POST.get('is_active') == 'on'
@@ -98,6 +104,12 @@ def user_role_delete(request, pk):
     """Удаление роли пользователя (отключение доступа)"""
     user_role = get_object_or_404(UserRole, pk=pk)
 
+    # Защита от самоблокировки
+    can_modify, error_message = RoleService.can_modify_user_role(request.user, user_role)
+    if not can_modify:
+        messages.error(request, error_message)
+        return redirect('user_roles:list')
+
     if request.method == 'POST':
         email = user_role.user.email
         user_role.delete()