apps/meteor/app/authorization/server/methods/removeUserFromRole.ts (1)

44-59: Missing permission gate when removing the admin role.

Users with generic 'access-permissions' can strip 'admin' from others unless blocked by "last admin" rule. Require 'assign-admin-role' here, mirroring addUserToRole.

   // prevent removing last user from admin role
   if (role._id === 'admin') {
+    // require elevated permission to modify the 'admin' role
+    if (!(await hasPermissionAsync(userId, 'assign-admin-role'))) {
+      throw new Meteor.Error('error-action-not-allowed', 'Removing admin is not allowed', {
+        method: 'authorization:removeUserFromRole',
+        action: 'Remove_admin',
+      });
+    }
+
     const adminCount = await Users.countDocuments({
       roles: {
         $in: ['admin'],
       },
     });
 
-    const userIsAdmin = user.roles?.indexOf('admin') > -1;
+    const userIsAdmin = user.roles?.includes('admin') === true;
     if (adminCount === 1 && userIsAdmin) {
       throw new Meteor.Error('error-action-not-allowed', 'Leaving the app without admins is not allowed', {
-        method: 'removeUserFromRole',
+        method: 'authorization:removeUserFromRole',
         action: 'Remove_last_admin',
       });
     }
   }

apps/meteor/app/lib/server/methods/setAdminStatus.ts (1)

45-51: Pass roleId (not role name) to addUserToRole/removeUserFromRole

addUserToRole/removeUserFromRole signatures are (userId: string, roleId: string, username: IUser['username'], scope?: string) (see apps/meteor/app/authorization/server/methods/{addUserToRole,removeUserFromRole}.ts). The code in apps/meteor/app/lib/server/methods/setAdminStatus.ts (lines ~45–51) still passes the literal 'admin' as the role — resolve the admin role's id and pass that roleId as the second argument; the username argument (user?.username) is correct.