Three admin-initiated endpoints let a caller change a user's role or study admin privileges but none of them notify the affected user:
PATCH /users/{userID}/role (UsersController.updateUserRole) — OperatorAdmin can change any user's role between OperatorAdmin, OrganisationAdmin, StudyAdmin, and ParticipantPOST /users/{userId}/make-study-admin/{studyId} (UsersController.makeStudyAdmin) — grants StudyAdmin over a specific studyPOST /users/{userId}/remove-study-admin/{studyId} (UsersController.removeStudyAdmin) — removes StudyAdmin from a specific study
Being promoted to OrganisationAdmin (or having admin privileges revoked) is an auth-relevant change the user should be aware of, both for their own visibility and as an audit signal in case the change was made by a compromised admin account.
Related to #928 and #929 which flag the same silent behaviour on password reset and profile edits.
Suggested fix: send a notification email on each of these transitions ("You have been made a StudyAdmin of X" / "Your CTRL admin role has been changed to Y" / "You are no longer a StudyAdmin of X. If this wasn't you, contact support.").
Three admin-initiated endpoints let a caller change a user's role or study admin privileges but none of them notify the affected user:
PATCH /users/{userID}/role(UsersController.updateUserRole) — OperatorAdmin can change any user's role between OperatorAdmin, OrganisationAdmin, StudyAdmin, and ParticipantPOST /users/{userId}/make-study-admin/{studyId}(UsersController.makeStudyAdmin) — grants StudyAdmin over a specific studyPOST /users/{userId}/remove-study-admin/{studyId}(UsersController.removeStudyAdmin) — removes StudyAdmin from a specific studyBeing promoted to OrganisationAdmin (or having admin privileges revoked) is an auth-relevant change the user should be aware of, both for their own visibility and as an audit signal in case the change was made by a compromised admin account.
Related to #928 and #929 which flag the same silent behaviour on password reset and profile edits.
Suggested fix: send a notification email on each of these transitions ("You have been made a StudyAdmin of X" / "Your CTRL admin role has been changed to Y" / "You are no longer a StudyAdmin of X. If this wasn't you, contact support.").