fix: restore bootstrap admin authority (#935)

Co-authored-by: Codex Agent <codex@hwlab.local>

internal/cloud/access-control.test.ts

@@ -1853,6 +1853,10 @@ test("cloud api bootstrap password synchronizes existing admin", async () => {
       password: "old-pass"
     });
     assert.equal(setup.status, 201);
+
+    const downgraded = await patchJson(port, "/v1/admin/access/users/usr_bootstrap_admin", { role: "user", status: "active" }, setup.cookie);
+    assert.equal(downgraded.status, 200);
+    assert.equal(downgraded.body.user.role, "user");
   } finally {
     await new Promise((resolve, reject) => firstServer.close((error) => (error ? reject(error) : resolve())));
   }
@@ -1884,6 +1888,11 @@ test("cloud api bootstrap password synchronizes existing admin", async () => {
     assert.equal(rotatedLogin.body.actor.username, "admin");
     assert.equal(rotatedLogin.body.actor.role, "admin");
     assert.equal(JSON.stringify(rotatedLogin.body).includes("rotated-pass"), false);
+
+    const summary = await getJson(port, "/v1/admin/access/summary", rotatedLogin.cookie);
+    assert.equal(summary.status, 200);
+    assert.equal(summary.body.actor.username, "admin");
+    assert.equal(summary.body.actor.role, "admin");
   } finally {
     await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
   }

internal/cloud/access-control.ts

@@ -1431,8 +1431,8 @@ class MemoryAccessStore {
   }
   async syncBootstrapAdminPassword(input) {
     const existing = await this.findUserByUsername(input.username) ?? await this.getUserById(input.id);
-    if (!existing || existing.role !== "admin") return null;
-    const user = { ...existing, passwordHash: input.passwordHash, updatedAt: input.now ?? this.now() };
+    if (!existing) return null;
+    const user = { ...existing, role: "admin", status: "active", passwordHash: input.passwordHash, updatedAt: input.now ?? this.now() };
     this.users.set(user.id, user);
     return user;
   }
@@ -1595,7 +1595,7 @@ class PostgresAccessStore extends MemoryAccessStore {
   async updateUserAccess(input = {}) { await this.ensureSchema(); const result = await this.query("UPDATE users SET role = $2, status = $3, updated_at = $4 WHERE id = $1 RETURNING id, username, display_name, role, status, password_hash, created_at, updated_at", [input.userId, input.role, input.status, input.now ?? this.now()]); return pgUser(result.rows?.[0]); }
   async syncBootstrapAdminPassword(input) {
     await this.ensureSchema();
-    const result = await this.query("UPDATE users SET password_hash = $3, updated_at = $4 WHERE role = 'admin' AND (username = $1 OR id = $2) RETURNING id, username, display_name, role, status, password_hash, created_at, updated_at", [input.username, input.id, input.passwordHash, input.now ?? this.now()]);
+    const result = await this.query("UPDATE users SET role = 'admin', status = 'active', password_hash = $3, updated_at = $4 WHERE username = $1 OR id = $2 RETURNING id, username, display_name, role, status, password_hash, created_at, updated_at", [input.username, input.id, input.passwordHash, input.now ?? this.now()]);
     return pgUser(result.rows?.[0]);
   }
   async createUser(input) {