fix: fraud dept balance restrictions

app/controllers/admin/users_controller.rb

@@ -228,9 +228,19 @@ def adjust_balance
     authorize :admin, :manage_users?
     @user = User.find(params[:id])
 
+    if cannot_adjust_balance_for?(@user)
+      flash[:alert] = "You cannot adjust the balance of another #{protected_role_name(@user)}."
+      return redirect_to admin_user_path(@user)
+    end
+
     amount = params[:amount].to_i
     reason = params[:reason].presence
 
+    if fraud_dept_cookie_limit_exceeded?(amount)
+      flash[:alert] = "Fraud department members can only grant up to 1 cookie without the grant_cookies permission."
+      return redirect_to admin_user_path(@user)
+    end
+
     if amount.zero?
       flash[:alert] = "Amount cannot be zero."
       return redirect_to admin_user_path(@user)
@@ -311,4 +321,38 @@ def update
   def user_params
     params.require(:user).permit(regions: [])
   end
+
+  def cannot_adjust_balance_for?(target_user)
+    return false if current_user.has_role?(:super_admin) || current_user.has_role?(:admin)
+
+    # Non-admins cannot adjust their own balance
+    return true if target_user == current_user
+
+    # Fraud dept cannot modify admin balances at all
+    if current_user.has_role?(:fraud_dept)
+      return true if target_user.has_role?(:admin) || target_user.has_role?(:super_admin)
+    end
+
+    protected_roles = [ :admin, :super_admin, :fraud_dept ]
+    shared_protected_roles = current_user.roles & protected_roles & target_user.roles
+    shared_protected_roles.any?
+  end
+
+  def fraud_dept_cookie_limit_exceeded?(amount)
+    return false unless current_user.has_role?(:fraud_dept)
+    return false if current_user.has_role?(:admin) || current_user.has_role?(:super_admin)
+    return false if Flipper.enabled?(:grant_cookies, current_user)
+
+    amount > 1
+  end
+
+  def protected_role_name(target_user)
+    if target_user.has_role?(:super_admin) || target_user.has_role?(:admin)
+      "admin"
+    elsif target_user.has_role?(:fraud_dept)
+      "fraud department member"
+    else
+      "user"
+    end
+  end
 end

app/models/user.rb

@@ -416,6 +416,7 @@ def track_identity_verified
   end
 
   def notify_role_granted(role)
+    return if Rails.env.development?
     return unless slack_id.present?
 
     role_info = User::Role.find(role)