fix(admin): restrict created users to normal role

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.test.tsx

@@ -204,7 +204,6 @@ describe('AddUserModal', () => {
         name: 'Canary Writer',
         email: 'writer@synthetics.example.com',
         password: 'canary-password',
-        role: 'user',
         emailVerified: true,
       },
       { onSuccess: expect.any(Function) }
@@ -213,15 +212,14 @@ describe('AddUserModal', () => {
     expect(onCreated).toHaveBeenCalledWith(CREATED_USER)
   })
 
-  it('supports platform-admin and unverified accounts', async () => {
+  it('supports unverified accounts without exposing a platform-role control', async () => {
     mockMutate.mockImplementation(
       (_input: AddUserInput, options: { onSuccess: (user: AdminUser) => void }) => {
-        options.onSuccess({ ...CREATED_USER, role: 'admin' })
+        options.onSuccess(CREATED_USER)
       }
     )
     await renderModal()
     await fillRequiredFields()
-    await changeField('Platform role', 'admin')
     await changeField('Email status', 'unverified')
 
     await act(async () => {
@@ -230,10 +228,10 @@ describe('AddUserModal', () => {
       await Promise.resolve()
     })
 
-    expect(mockMutate).toHaveBeenCalledWith(
-      expect.objectContaining({ role: 'admin', emailVerified: false }),
-      { onSuccess: expect.any(Function) }
-    )
+    expect(container.querySelector('[aria-label="Platform role"]')).toBeNull()
+    expect(mockMutate).toHaveBeenCalledWith(expect.objectContaining({ emailVerified: false }), {
+      onSuccess: expect.any(Function),
+    })
   })
 
   it('shows Better Auth failures without closing the modal', async () => {

apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.tsx

@@ -11,12 +11,7 @@ import {
 } from '@sim/emcn'
 import { getErrorMessage } from '@sim/utils/errors'
 import { isValidEmailSyntax } from '@sim/utils/string'
-import { type AddUserInput, type AdminUser, useAddUser } from '@/hooks/queries/admin-users'
-
-const ROLE_OPTIONS = [
-  { value: 'user', label: 'User' },
-  { value: 'admin', label: 'Platform admin' },
-] as const
+import { type AdminUser, useAddUser } from '@/hooks/queries/admin-users'
 
 const EMAIL_STATUS_OPTIONS = [
   { value: 'verified', label: 'Verified' },
@@ -34,7 +29,6 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
   const [name, setName] = useState('')
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
-  const [role, setRole] = useState<AddUserInput['role']>('user')
   const [emailVerified, setEmailVerified] = useState(true)
 
   const normalizedName = name.trim()
@@ -56,7 +50,6 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
     setName('')
     setEmail('')
     setPassword('')
-    setRole('user')
     setEmailVerified(true)
     addUser.reset()
   }
@@ -75,7 +68,6 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
         name: normalizedName,
         email: normalizedEmail,
         password,
-        role,
         emailVerified,
       },
       {
@@ -143,19 +135,6 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
           disabled={addUser.isPending}
           required
         />
-        <ChipModalField
-          type='dropdown'
-          title='Platform role'
-          value={role}
-          onChange={(value) => {
-            setRole(value as AddUserInput['role'])
-            addUser.reset()
-          }}
-          options={ROLE_OPTIONS}
-          align='start'
-          disabled={addUser.isPending}
-          required
-        />
         <ChipModalField
           type='dropdown'
           title='Email status'

apps/sim/hooks/queries/admin-users.test.ts

@@ -42,7 +42,6 @@ describe('addUser', () => {
         name: '  Canary Writer  ',
         email: '  Writer@Synthetics.Example.com ',
         password: 'canary-password',
-        role: 'user',
         emailVerified: true,
       })
     ).resolves.toEqual({
@@ -73,7 +72,6 @@ describe('addUser', () => {
         name: 'Canary Writer',
         email: 'writer@synthetics.example.com',
         password: 'canary-password',
-        role: 'user',
         emailVerified: true,
       })
     ).rejects.toThrow('A user with that email already exists')
@@ -87,7 +85,6 @@ describe('addUser', () => {
         name: 'Canary Writer',
         email: 'writer@synthetics.example.com',
         password: 'canary-password',
-        role: 'user',
         emailVerified: true,
       })
     ).rejects.toThrow('Better Auth did not return the created user')

apps/sim/hooks/queries/admin-users.ts

@@ -28,7 +28,6 @@ export interface AddUserInput {
   name: string
   email: string
   password: string
-  role: 'user' | 'admin'
   emailVerified: boolean
 }
 
@@ -59,14 +58,13 @@ export async function addUser({
   name,
   email,
   password,
-  role,
   emailVerified,
 }: AddUserInput): Promise<AdminUser> {
   const { data, error } = await client.admin.createUser({
     name: name.trim(),
     email: email.trim().toLowerCase(),
     password,
-    role,
+    role: 'user',
     data: { emailVerified },
   })
   if (error) throw new Error(error.message ?? 'Failed to add user')