From 5d32e2dca5fc458a23b543917ef758d97a109765 Mon Sep 17 00:00:00 2001
From: Methapon Metanipat <methapon@frappet.com>
Date: Thu, 5 Sep 2024 11:03:45 +0700
Subject: [PATCH] fix: fix no perm

---
 src/controllers/02-user-controller.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/controllers/02-user-controller.ts b/src/controllers/02-user-controller.ts
index 45e8808..a697223 100644
--- a/src/controllers/02-user-controller.ts
+++ b/src/controllers/02-user-controller.ts
@@ -381,7 +381,7 @@ export class UserController extends Controller {
     const THROW_PERM_MSG = "You do not have permission to perform this action.";
     const THROW_PERM_CODE = "noPermission";
 
-    if (setRoleIndex < userRoleIndex) {
+    if (setRoleIndex !== -1 && setRoleIndex < userRoleIndex) {
       throw new HttpError(HttpStatus.FORBIDDEN, THROW_PERM_MSG, THROW_PERM_CODE);
     }
     if (!globalAllow(req.user)) {