mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Service level: BAN_MEMBERS refusal (Forbidden even for nonexistent targets — no id enumeration), equal-rank and owner-target hierarchy refusals, authorized ban/unban round-trip, self-ban rejection. Admin API level: equal-rank owner ban 403s, a lower-positioned ADMINISTRATOR cannot ban the owner, downward bans still work. All existing NewAdminAPI/NewHandler test callsites now inject a real ModerationService so the production authorization runs in every PATCH-user test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>