From d421fba472718d9d4488b751a4368c7823a7a8bc Mon Sep 17 00:00:00 2001 From: weichen Date: Sun, 13 Sep 2026 11:37:03 +0000 Subject: [PATCH] fix(api): fail closed when status update cannot set user role Return the UpdateUserRole error instead of silently continuing when an admin approves a user with an explicit role_id. Co-authored-by: Cursor --- internal/server/auth_handlers.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/internal/server/auth_handlers.go b/internal/server/auth_handlers.go index a75862d4..62f0cd8b 100644 --- a/internal/server/auth_handlers.go +++ b/internal/server/auth_handlers.go @@ -294,7 +294,10 @@ func (s *Server) handleAdminUpdateStatus(w http.ResponseWriter, r *http.Request) } if req.RoleID != "" { - _, _ = s.authSvc.UpdateUserRole(r.Context(), targetID, req.RoleID, req.Position) + if _, roleErr := s.authSvc.UpdateUserRole(r.Context(), targetID, req.RoleID, req.Position); roleErr != nil { + http.Error(w, roleErr.Error(), http.StatusBadRequest) + return + } } updated, err := s.authSvc.UpdateUserStatus(r.Context(), targetID, req.Status)