From f2d8c53292827222fcde1ab422b0c38c587ee3c3 Mon Sep 17 00:00:00 2001
From: Randy Hammond <revtex@gmail.com>
Date: Sat, 25 Apr 2026 22:01:42 +0000
Subject: [PATCH] fix(admin): lock primary admin's Allowed Systems to all

The first user (id=1) is the primary admin and always has access to every system. Disable the Allowed Systems badges in the edit modal (all shown as selected, non-clickable, with explanatory text) and force systemsJson=null on save for editingId===1 so any pre-existing restriction gets cleared.
---
 CHANGELOG.md                                 |  1 +
 frontend/src/components/admin/UsersPanel.tsx | 32 ++++++++++++++++----
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 37ff156..003b492 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -95,6 +95,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Lock the primary admin's Allowed Systems selector in the user editor; the first user always has access to every system and the badges are now read-only with all systems shown as allowed.
 - Default `audioEncodingPreset` seeded into the settings table is now
   `mp3_32k` (matching the dropdown's "(default)" label and the Go
   `ParseEncodingPreset` fallback) instead of `aac_lc_32k`. New installs
diff --git a/frontend/src/components/admin/UsersPanel.tsx b/frontend/src/components/admin/UsersPanel.tsx
index 05325db..2e4573f 100644
--- a/frontend/src/components/admin/UsersPanel.tsx
+++ b/frontend/src/components/admin/UsersPanel.tsx
@@ -107,9 +107,13 @@ export default function UsersPanel() {
     e.preventDefault();
     try {
       if (editingId != null) {
+        const payload = formToUpdatePayload(form);
+        if (editingId === 1) {
+          payload.systemsJson = null;
+        }
         await updateUser({
           id: editingId,
-          ...formToUpdatePayload(form),
+          ...payload,
         }).unwrap();
       } else {
         await createUser(formToCreatePayload(form)).unwrap();
@@ -403,25 +407,41 @@ export default function UsersPanel() {
                 <div className="flex flex-col gap-1 mt-3">
                   <span className="text-sm font-medium">Allowed Systems</span>
                   <span className="text-xs text-base-content/60">
-                    Select which systems this user can access. If none selected,
-                    all systems are allowed.
+                    {editingId === 1
+                      ? "The primary admin always has access to all systems."
+                      : "Select which systems this user can access. If none selected, all systems are allowed."}
                   </span>
                   <div className="flex flex-wrap gap-2 mt-1">
                     {systems
                       .slice()
                       .sort((a, b) => a.order - b.order)
                       .map((sys) => {
-                        const selected = selectedSystems.includes(sys.id);
+                        const selected =
+                          editingId === 1 || selectedSystems.includes(sys.id);
+                        const locked = editingId === 1;
                         return (
                           <button
                             key={sys.id}
                             type="button"
-                            className={`badge badge-lg gap-1.5 cursor-pointer transition-colors ${
+                            disabled={locked}
+                            aria-disabled={locked}
+                            className={`badge badge-lg gap-1.5 transition-colors ${
+                              locked
+                                ? "cursor-not-allowed opacity-60"
+                                : "cursor-pointer"
+                            } ${
                               selected
                                 ? "badge-primary"
                                 : "badge-ghost hover:badge-outline"
                             }`}
-                            onClick={() => toggleSystem(sys.id)}
+                            onClick={() => {
+                              if (!locked) toggleSystem(sys.id);
+                            }}
+                            title={
+                              locked
+                                ? "The primary admin always has access to all systems."
+                                : undefined
+                            }
                           >
                             <span
                               className={`inline-block w-2 h-2 rounded-full ${