[jnnngs]

📋 Findings

Functional:

1. authadmin.go adminUpdateUser (Medium): any role string other than "admin" was read as "user", so a typo such as "administrator" or an empty string silently demoted the account. Fixed here.
2. authadmin.go adminCreateUser (Low): same coercion; an unknown role creates a plain user instead of a 400.
3. authadmin.go applyGroupRole (Low/ambiguous): any non-admin string clears the group's role. Empty may be intentional, so this is left alone.
4. authadmin.go adminUpdateUser (Low): changes are applied step by step, so an invalid password after a valid role change returns 400 with the role already changed (partial apply).
5. apitoken.Verify (Low): rewrites the whole token file on every authenticated call, under the lock (best-effort last used stamp).

UX: none verified in the time available.

🐛 Fixed

Finding 1. adminUpdateUser now accepts only "admin" or "user" (case-insensitive, trimmed) and answers 400 otherwise.
Verified with TestAdminUpdateUserRejectsUnknownRole: it fails without the fix (the account is demoted and the call returns 200) and passes with it. gofmt, go vet and go test -short ./... are clean and the build succeeds. The full non-short suite was not run.

⚠️ Risk/Follow-up

The change is limited to the admin JSON API. The admin UI only sends "admin" and "user". It does not touch the packages shared with 3270Web, so nothing needs copying across.

❓ Questions

• Should account creation reject unknown roles too (finding 2)?
• Should an empty or unknown group role clear the assignment (finding 3), or be rejected?

📝 Noted, not fixed

Findings 2 to 5 above. Also, tokenScopeAllows requires the "read" scope for GET, so a write-only token cannot read. This may be intended.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-13T07:51:22.601750Z We couldn’t complete this review. Comment @codex review to try again.	13471e9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.