SecureBananaLabs/bug-bounty: fix: prevent admin role self-assignment

The gap in what exists

This is a direct bounty for a specific security fix, representing a clear unmet need for a specific organization.

Wedge to win

Solve the security vulnerability directly for SecureBananaLabs to earn the bounty and build a security-focused portfolio.

Reputation value (worth doing free for proof) — 70/100

Successfully delivering a security fix for a public bug bounty platform demonstrates strong security development skills, valuable for future freelance or contract work.

Likely monetization

bounty/contract work

You are a highly skilled security-focused developer. I need you to implement a fix for a security vulnerability in a GitHub repository. The task is to prevent an authenticated admin user from self-assigning the 'admin' role. This is similar to issue #1378 regarding registration role restriction. Assume the codebase is a standard web application with typical user management. Your goal is to deliver a robust and tested fix.

Here's the plan:
1.  **Repository Analysis**: Quickly analyze the user management and role assignment logic in the target repository (SecureBananaLabs/bug-bounty). Focus on API endpoints or functions that handle user registration, profile updates, or direct role modifications.
2.  **Identify Vulnerable Path**: Pinpoint the exact code location(s) where an admin could potentially elevate their own privileges to 'admin' if they already possess admin privileges.
3.  **Implement Server-Side Validation**: Add server-side validation logic to prevent an existing admin from assigning the 'admin' role to their own user account. This might involve checking the current user's role during the assignment process and rejecting the operation if it attempts to grant 'admin' to themselves.
4.  **Test Cases**: Create a new test file or add to existing test suites (e.g., unit tests, integration tests) that specifically covers this scenario. Test cases should include:
    *   An admin user attempting to assign 'admin' to their own account (should fail).
    *   An admin user attempting to assign 'admin' to another non-admin account (should succeed if intended, or fail if restricted by other rules).
    *   A non-admin user attempting to assign 'admin' to any account (should fail).
5.  **Output**: Provide the modified code files, new test files, and clear instructions on how to run the tests and verify the fix. Assume a Node.js/TypeScript stack for implementation unless the repo clearly indicates otherwise. Focus on clarity, security best practices, and maintainability.