porchlight/tests/test_admin
Johan Lundberg aedb451128
fix(security): prevent removing the last active admin
Admins could remove the admin group from, deactivate, or delete the last
active admin, locking the system out of all administration. Add a
count_active_admins() repo method and a _is_last_active_admin() guard, and
block all three operations when they would leave zero active admins.

Refs: porchlight-yq7

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-05 13:31:39 +02:00
..
__init__.py feat: add admin router with admin group guard 2026-02-19 11:18:50 +01:00
test_admin_guard.py fix: add CSRF token handling to admin tests after merge 2026-02-19 15:02:51 +01:00
test_admin_routes.py fix(security): prevent removing the last active admin 2026-06-05 13:31:39 +02:00