From ba96f52ed6e8c88d42fbb86715951d878eb4e298 Mon Sep 17 00:00:00 2001
From: Hampus <hampus@fluxer.app>
Date: Thu, 20 Aug 2026 21:09:56 +0200
Subject: [PATCH] fix(schema): allow assigning every admin ACL to a user
 (#1797)

---
 .../domains/admin/AdminUserSchemas.test.ts    | 19 +++++++++++++++++++
 .../src/domains/admin/AdminUserSchemas.ts     |  7 +++++--
 2 files changed, 24 insertions(+), 2 deletions(-)
 create mode 100644 packages/schema/src/domains/admin/AdminUserSchemas.test.ts

diff --git a/packages/schema/src/domains/admin/AdminUserSchemas.test.ts b/packages/schema/src/domains/admin/AdminUserSchemas.test.ts
new file mode 100644
index 000000000..1d3ca202b
--- /dev/null
+++ b/packages/schema/src/domains/admin/AdminUserSchemas.test.ts
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
+import {SetUserAclsRequest} from '@fluxer/schema/src/domains/admin/AdminUserSchemas';
+import {describe, expect, test} from 'vitest';
+
+describe('SetUserAclsRequest', () => {
+	test('accepts every ACL the instance defines', () => {
+		const acls = Object.values(AdminACLs);
+		const result = SetUserAclsRequest.safeParse({user_id: '1', acls});
+		expect(result.success).toBe(true);
+	});
+
+	test('rejects more entries than there are ACLs', () => {
+		const acls = [...Object.values(AdminACLs), 'overflow:one'];
+		const result = SetUserAclsRequest.safeParse({user_id: '1', acls});
+		expect(result.success).toBe(false);
+	});
+});
diff --git a/packages/schema/src/domains/admin/AdminUserSchemas.ts b/packages/schema/src/domains/admin/AdminUserSchemas.ts
index 9bc13103d..1c0625cf1 100644
--- a/packages/schema/src/domains/admin/AdminUserSchemas.ts
+++ b/packages/schema/src/domains/admin/AdminUserSchemas.ts
@@ -8,6 +8,7 @@ import {
 	UserFlags,
 	UserFlagsDescriptions,
 } from '@fluxer/constants/src/UserConstants';
+import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
 import {NSFWLevelSchema} from '@fluxer/schema/src/primitives/GuildValidators';
 import {
 	createBitflagInt32Type,
@@ -21,6 +22,8 @@ import {
 import {DiscriminatorType, EmailType, UsernameType} from '@fluxer/schema/src/primitives/UserValidators';
 import {z} from 'zod';
 
+const ADMIN_ACL_COUNT = Object.keys(AdminACLs).length;
+
 export const UserAdminResponseSchema = z.object({
 	id: SnowflakeStringType,
 	username: z.string(),
@@ -65,7 +68,7 @@ export const UserAdminResponseSchema = z.object({
 	pending_bulk_message_deletion_at: z.string().nullable(),
 	deletion_reason_code: Int32Type.nullable(),
 	deletion_public_reason: z.string().nullable(),
-	acls: z.array(z.string()).max(100),
+	acls: z.array(z.string()).max(ADMIN_ACL_COUNT),
 	traits: z.array(z.string()).max(100),
 	has_totp: z.boolean(),
 	authenticator_types: z.array(Int32Type).max(10),
@@ -353,7 +356,7 @@ export type ScheduleAccountDeletionRequest = z.infer<typeof ScheduleAccountDelet
 
 export const SetUserAclsRequest = z.object({
 	user_id: SnowflakeType.describe('ID of the user to set ACLs for'),
-	acls: z.array(createStringType(1, 64)).max(100).describe('List of access control permissions to assign'),
+	acls: z.array(createStringType(1, 64)).max(ADMIN_ACL_COUNT).describe('List of access control permissions to assign'),
 });
 
 export type SetUserAclsRequest = z.infer<typeof SetUserAclsRequest>;