# 撤销管理员权限后用户仍拥有 TL4

**URL:** https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576
**Category:** Support
**Created:** [2018年四月4日 14:55 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576 "2018-04-04T14:55:10Z")
**Posts on this page:** 18
**Page:** 1

<div class="post-metadata">

### Author: ![Ivan\_Rapekas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ivan_rapekas/32/248924_2.png) [@Ivan\_Rapekas](https://meta.discourse.org/u/Ivan_Rapekas)
#### Post date: [2018年四月4日 14:55 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/1 "2018-04-04T14:55:10Z")

</div>

I registered in forum using Google account with TL1. Then I grant admin rights using `rake admin:invite[****** @gmail.com]`. The user gets `Admin+TL4`.  
After that I revoke admin grants, but TL4 did not revert back to TL1.

Discourse 1.9.4

---

<div class="post-metadata">

### Author: ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [2018年四月4日 15:20 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/2 "2018-04-04T15:20:28Z")

</div>

Relevant file for admin:invite (for those wondering)

> <https://github.com/discourse/discourse/blob/main/lib/tasks/admin.rake#L3-L28>

Which definitely applies TL4, I’m not convinced that revoke was programmed with the intent of resetting their TL though.

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [2018年四月4日 15:39 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/3 "2018-04-04T15:39:03Z")

</div>

This is the first I’ve heard of this rake task. I dig see why it applies user level 4,but if you use it you’ll need to remove tl4 if you want the user not to be tl4.

---

<div class="post-metadata">

### Author: ![barreeeiroo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/barreeeiroo/32/165264_2.png) [@barreeeiroo](https://meta.discourse.org/u/barreeeiroo)
#### Post date: [2018年四月4日 16:23 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/4 "2018-04-04T16:23:19Z")

</div>

I don’t think this is a bug

Moderation ranks (moderator and admin) aren’t releated with Trust Level  
A TL0 can be a moderator or admin, while a TL4 can just be a TL4. It doesn’t depend on it

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [2018年四月4日 16:45 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/5 "2018-04-04T16:45:22Z")

</div>

> [@barreeeiroo](#):
>
> A TL0 can be a moderator or admin, while a TL4 can just be a TL4. It doesn’t depend on it

That’s inaccurate, the file @cpradio quoted makes the user TL4.

> [@cpradio](#):
>
> user.change\_trust\_level!(4)

It’s not a question of whether a TL4 user “can just be TL4”, it’s about the expected behavior when admin is revoked and the implications of leaving the trust level in-place.

[TL4 users are leaders](https://meta.discourse.org/t/what-do-user-trust-levels-do/4924/7), even without admin they can edit all posts, pin and unpin topics, close and archive topics. That’s still quite a lot of power for a user you may no longer want to have admin rights.

---

<div class="post-metadata">

### Author: ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [2018年四月4日 16:49 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/6 "2018-04-04T16:49:18Z")

</div>

> [@steve\_pd](#):
>
> That’s inaccurate, the file @cpradio quoted makes the user TL4.

No, he is correct. Moderator/Admin abilities have zero dependencies on TL4, what isn’t clear is why this rake tasks sets the invited admin to TL4. If you were to use the Admin \> User UI, you would not get that same behavior by clicking “Grant Admin” on a user.

The rake task is doing it for some reason, but I didn’t do a blame to try and get some insight on the matter.

With all of that said, if there were a rake task that removed admin rights, I’d expect it to remove TL4 too, but if you revoke it via the UI, well… I can’t really blame the UI for not altering the Trust Level

---

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [2018年四月4日 16:52 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/7 "2018-04-04T16:52:46Z")

</div>

Looking at `git blame` it appears that promotion to TL4 has been part of the rake task since @sam wrote it 4 years ago. He might have some insight.

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [2018年四月4日 16:55 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/8 "2018-04-04T16:55:16Z")

</div>

> [@cpradio](#):
>
> No, he is correct. Moderator/Admin abilities have zero dependencies on TL4, what isn’t clear is why this rake tasks sets the invited admin to TL4.

You probably misinterpreted my post, @barreeeiroo said that this isn’t a bug, and that ranks aren’t related to TL. The OP has flagged that unlike granting admin on the user, admin:invite does change both rank and trust level. There’s no need to do this, right? While admin:invite does both the two are linked, at least for now.

---

<div class="post-metadata">

### Author: ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [2018年四月4日 16:58 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/9 "2018-04-04T16:58:39Z")

</div>

You might want to read my full reply, but I acknowledge it does it and gave reasons why I still feel it is not a bug. 😉

---

<div class="post-metadata">

### Author: ![Ivan\_Rapekas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ivan_rapekas/32/248924_2.png) [@Ivan\_Rapekas](https://meta.discourse.org/u/Ivan_Rapekas)
#### Post date: [2018年四月4日 18:40 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/10 "2018-04-04T18:40:20Z")

</div>

As mentioned above, granting the user by UI, TL is not changed. But using CLI (this is a way to make new user an admin silently from other admins, because they don’t get a confirmation email in this case), user gets TL4 with admins rights. Either UI should change TL to 4 or CLI method should keep TL.

Anyway, my topic is about the bug. I assume that revoking admin status must drop the user to the TL that they have before granting. I wrote, that user came to the forum with TL1. So, in case of revoking, they have to descend to regular.

The parallel: some person got a job in The United Nations, and they also got apartaments in NY and a car with a personal driver. After a week of working, the person has fired, they lost apartments, but having its TL4, they still use a car with a driver. As a gift 🎁.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年四月5日 00:41 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/11 "2018-04-05T00:41:13Z")

</div>

> [@cpradio](#):
>
> what isn’t clear is why this rake tasks sets the invited admin to TL4

Do we need this @sam? It seems excessive to me.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年四月5日 00:48 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/12 "2018-04-05T00:48:56Z")

</div>

There are actually two rake tasks that follow the same pattern of granting tl4 to admins it creates/invites.

`rake admin:invite` and `rake admin:create` both are useful tasks I would like to keep.

I think it is totally unfair to class this as a bug, maybe we should pop a window saying “user has tl4 you just revoked admin do you want to revoke tl4 as well?”

As to granting tl when inviting admin, I guess I am ok with just setting tl to 1 for these tasks, I will change this now.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年四月5日 00:51 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/13 "2018-04-05T00:51:17Z")

</div>

Yeah I just don’t see why TL needs to be changed when you make someone an admin..

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年四月5日 00:52 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/14 "2018-04-05T00:52:20Z")

</div>

I think there were some edges in the system some time in the past when you had an admin on tl0, seems pretty safe to bump them up to 1 though in these tasks.

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [2018年四月5日 02:05 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/15 "2018-04-05T02:05:09Z")

</div>

There is still some oddness present, for example admins don’t bypass checks such as “max images per post” that are bypassed by trust level.

I noticed the other week as some of our hosted customers have demoted the TL of discobot and it’s no longer able to work properly on those sites.

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [2018年四月5日 04:23 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/19 "2018-04-05T04:23:56Z")

</div>

> [@supermathie](#):
>
> admins don’t bypass checks such as “max images per post” that are bypassed by trust level

Fixed in:

[https://github.com/discourse/discourse/commit/10759677db5d0cd2bd372adefd0ac77fd47bf8f0](https://github.com/discourse/discourse/commit/10759677db5d0cd2bd372adefd0ac77fd47bf8f0)

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [2020年八月11日 11:36 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/20 "2020-08-11T11:36:14Z")

</div>



---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2020年八月11日 14:17 UTC](https://meta.discourse.org/t/user-still-have-tl4-after-revoke-admin-grants/84576/21 "2020-08-11T14:17:13Z")

</div>


