fix(platform): protect system role menus

backend/api/internal/logic/platform/resource_test.go

@@ -177,6 +177,21 @@ func TestReplacePlatformRoleMenusAllowsAnEmptySetToClearAssignmentsTransactional
 	assertMockExpectations(t, mock)
 }
 
+func TestReplacePlatformRoleMenusRejectsSystemRoleBeforeChangingRelations(t *testing.T) {
+	_, mock := setupPlatformRoleDatabase(t)
+	mock.ExpectBegin()
+	mock.ExpectQuery(regexp.QuoteMeta(`SELECT * FROM "platform_role" WHERE identity = $1 ORDER BY "platform_role"."id" LIMIT $2`)).
+		WithArgs("root-role", 1).
+		WillReturnRows(platformSystemRoleRows("root-role"))
+	mock.ExpectRollback()
+
+	ctx, recorder := updateContext(http.MethodPut, "/roles/root-role/menus", "root-role", []byte(`{"menu_identities":[]}`))
+	ReplacePlatformRoleMenus(ctx)
+
+	assertResponseCode(t, recorder, int32(status.Code(errcode.ErrInvalidArgument)))
+	assertMockExpectations(t, mock)
+}
+
 type responseBody struct {
 	Code    int32           `json:"code"`
 	Message string          `json:"message"`
@@ -207,6 +222,11 @@ func platformRoleRows(identity string) *sqlmock.Rows {
 		AddRow(uint64(1), identity, nil, nil, "enabled", 1, identity, identity, "global", false)
 }
 
+func platformSystemRoleRows(identity string) *sqlmock.Rows {
+	return sqlmock.NewRows([]string{"id", "identity", "created_at", "updated_at", "status", "version", "role_code", "name", "data_scope", "is_system"}).
+		AddRow(uint64(1), identity, nil, nil, "enabled", 1, identity, identity, "global", true)
+}
+
 func updateContext(method, target, identity string, body []byte) (*gin.Context, *httptest.ResponseRecorder) {
 	recorder := httptest.NewRecorder()
 	ctx, _ := gin.CreateTestContext(recorder)