Add role write:admin:create-account

locales/en-US.yml

@@ -2119,6 +2119,7 @@ _permissions:
   "read:flash-likes": "View list of liked Plays"
   "write:flash-likes": "Edit list of liked Plays"
   "read:admin:abuse-user-reports": "View user reports"
+  "write:admin:create-account": "Create user account"
   "write:admin:delete-account": "Delete user account"
   "write:admin:delete-all-files-of-a-user": "Delete all files of a user"
   "read:admin:index-stats": "View database index stats"

locales/index.d.ts

@@ -8238,6 +8238,10 @@ export interface Locale extends ILocale {
          * ユーザーからの通報を見る
          */
         "read:admin:abuse-user-reports": string;
+        /**
+         * ユーザーアカウントを作成する
+         */
+        "write:admin:create-account": string;
         /**
          * ユーザーアカウントを削除する
          */

locales/ja-JP.yml

@@ -2163,6 +2163,7 @@ _permissions:
   "read:flash-likes": "Playのいいねを見る"
   "write:flash-likes": "Playのいいねを操作する"
   "read:admin:abuse-user-reports": "ユーザーからの通報を見る"
+  "write:admin:create-account": "ユーザーアカウントを作成する"
   "write:admin:delete-account": "ユーザーアカウントを削除する"
   "write:admin:delete-all-files-of-a-user": "ユーザーのすべてのファイルを削除する"
   "read:admin:index-stats": "データベースインデックスに関する情報を見る"

packages/backend/src/server/api/endpoints/admin/accounts/create.ts

@@ -92,6 +92,9 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			} else if (!(me?.isRoot) && !await this.roleService.isAdministrator(me)) {
 				// 管理者でない場合
 				throw new ApiError(meta.errors.accessDenied);
+			} else if (!(token?.permission.includes('write:admin:create-account') ?? false)) {
+				// access token を使うときは write:admin:create-account 権限が必要
+				throw new ApiError(meta.errors.accessDenied);
 			}
 
 			const { account, secret } = await this.signupService.signup({

packages/backend/test/e2e/admin-create-account.ts

@@ -64,7 +64,7 @@ describe('Admin Create User', () => {
 
     test('Revoking Admin Role', async () => {
         const res = await api('admin/roles/delete', {roleId: formerAdminRole.id}, admin);
-        assert.strictEqual(res.status, 200);
+        assert.strictEqual(res.status, 204);
 
         const res2 = await api('admin/roles/delete', {roleId: adminRole.id}, formerAdmin);
         assert.strictEqual(res2.status, 403);

packages/misskey-js/etc/misskey-js.api.md

@@ -2876,7 +2876,7 @@ type PartialRolePolicyOverride = Partial<{
 }>;
 
 // @public (undocumented)
-export const permissions: readonly ["read:account", "write:account", "read:blocks", "write:blocks", "read:drive", "write:drive", "read:favorites", "write:favorites", "read:following", "write:following", "read:messaging", "write:messaging", "read:mutes", "write:mutes", "write:notes", "read:notifications", "write:notifications", "read:reactions", "write:reactions", "write:votes", "read:pages", "write:pages", "write:page-likes", "read:page-likes", "read:user-groups", "write:user-groups", "read:channels", "write:channels", "read:gallery", "write:gallery", "read:gallery-likes", "write:gallery-likes", "read:flash", "write:flash", "read:flash-likes", "write:flash-likes", "read:admin:abuse-user-reports", "write:admin:delete-account", "write:admin:delete-all-files-of-a-user", "read:admin:index-stats", "read:admin:table-stats", "read:admin:user-ips", "read:admin:meta", "write:admin:reset-password", "write:admin:resolve-abuse-user-report", "write:admin:send-email", "read:admin:server-info", "read:admin:show-moderation-log", "read:admin:show-user", "write:admin:suspend-user", "write:admin:unset-user-avatar", "write:admin:unset-user-banner", "write:admin:unsuspend-user", "write:admin:meta", "write:admin:user-note", "write:admin:roles", "read:admin:roles", "write:admin:relays", "read:admin:relays", "write:admin:invite-codes", "read:admin:invite-codes", "write:admin:announcements", "read:admin:announcements", "write:admin:avatar-decorations", "read:admin:avatar-decorations", "write:admin:federation", "write:admin:account", "read:admin:account", "write:admin:emoji", "read:admin:emoji", "write:admin:queue", "read:admin:queue", "write:admin:promo", "write:admin:drive", "read:admin:drive", "write:admin:ad", "read:admin:ad", "write:invite-codes", "read:invite-codes", "write:clip-favorite", "read:clip-favorite", "read:federation", "write:report-abuse"];
+export const permissions: readonly ["read:account", "write:account", "read:blocks", "write:blocks", "read:drive", "write:drive", "read:favorites", "write:favorites", "read:following", "write:following", "read:messaging", "write:messaging", "read:mutes", "write:mutes", "write:notes", "read:notifications", "write:notifications", "read:reactions", "write:reactions", "write:votes", "read:pages", "write:pages", "write:page-likes", "read:page-likes", "read:user-groups", "write:user-groups", "read:channels", "write:channels", "read:gallery", "write:gallery", "read:gallery-likes", "write:gallery-likes", "read:flash", "write:flash", "read:flash-likes", "write:flash-likes", "read:admin:abuse-user-reports", "write:admin:create-account", "write:admin:delete-account", "write:admin:delete-all-files-of-a-user", "read:admin:index-stats", "read:admin:table-stats", "read:admin:user-ips", "read:admin:meta", "write:admin:reset-password", "write:admin:resolve-abuse-user-report", "write:admin:send-email", "read:admin:server-info", "read:admin:show-moderation-log", "read:admin:show-user", "write:admin:suspend-user", "write:admin:unset-user-avatar", "write:admin:unset-user-banner", "write:admin:unsuspend-user", "write:admin:meta", "write:admin:user-note", "write:admin:roles", "read:admin:roles", "write:admin:relays", "read:admin:relays", "write:admin:invite-codes", "read:admin:invite-codes", "write:admin:announcements", "read:admin:announcements", "write:admin:avatar-decorations", "read:admin:avatar-decorations", "write:admin:federation", "write:admin:account", "read:admin:account", "write:admin:emoji", "read:admin:emoji", "write:admin:queue", "read:admin:queue", "write:admin:promo", "write:admin:drive", "read:admin:drive", "write:admin:ad", "read:admin:ad", "write:invite-codes", "read:invite-codes", "write:clip-favorite", "read:clip-favorite", "read:federation", "write:report-abuse"];
 
 // @public (undocumented)
 type PingResponse = operations['ping']['responses']['200']['content']['application/json'];

packages/misskey-js/src/autogen/apiClientJSDoc.ts

@@ -88,7 +88,7 @@ declare module '../api.js' {
     /**
      * No description provided.
      * 
-     * **Credential required**: *No*
+     * **Credential required**: *No* / **Permission**: *write:admin:create-account*
      */
     request<E extends 'admin/accounts/create', P extends Endpoints[E]['req']>(
       endpoint: E,

packages/misskey-js/src/autogen/types.ts

@@ -85,7 +85,7 @@ export type paths = {
      * admin/accounts/create
      * @description No description provided.
      *
-     * **Credential required**: *No*
+     * **Credential required**: *No* / **Permission**: *write:admin:create-account*
      */
     post: operations['admin___accounts___create'];
   };
@@ -5659,7 +5659,7 @@ export type operations = {
    * admin/accounts/create
    * @description No description provided.
    *
-   * **Credential required**: *No*
+   * **Credential required**: *No* / **Permission**: *write:admin:create-account*
    */
   admin___accounts___create: {
     requestBody: {

packages/misskey-js/src/consts.ts

@@ -64,6 +64,7 @@ export const permissions = [
 	'read:flash-likes',
 	'write:flash-likes',
 	'read:admin:abuse-user-reports',
+	'write:admin:create-account',
 	'write:admin:delete-account',
 	'write:admin:delete-all-files-of-a-user',
 	'read:admin:index-stats',