Merge pull request #28451 from wmortada/standalone-protected-roles

Standalone - Protect admin and everyone roles

ext/standaloneusers/CRM/Standaloneusers/BAO/Role.php

@@ -14,4 +14,25 @@ public static function self_hook_civicrm_post(\Civi\Core\Event\PostEvent $event)
     Civi::cache('metadata')->clear();
   }
 
+  /**
+   * Check access permission
+   *
+   * @param string $entityName
+   * @param string $action
+   * @param array $record
+   * @param integer|null $userID
+   * @return boolean
+   * @see CRM_Core_DAO::checkAccess
+   */
+  public static function _checkAccess(string $entityName, string $action, array $record, ?int $userID): bool {
+    // Prevent users from updating or deleting the admin and everyone roles
+    if (in_array($action, ['delete', 'update'], TRUE)) {
+      $name = $record['name'] ?? CRM_Core_DAO::getFieldValue(self::class, $record['id']);
+      if (in_array($name, ['admin', 'everyone'], TRUE)) {
+        return FALSE;
+      }
+    }
+    return TRUE;
+  }
+
 }