Disallow inviting employee or system accounts.

r2/r2/controllers/api.py

@@ -4882,6 +4882,11 @@ def POST_adddeveloper(self, form, jquery, client, account):
             c.errors.add(errors.DEVELOPER_FIRST_PARTY_APP, field='name')
             form.set_error(errors.DEVELOPER_FIRST_PARTY_APP, 'name')
             return
+        if ((account.employee or account == Account.system_user()) and
+           not c.user_is_admin):
+            c.errors.add(errors.DEVELOPER_PRIVILEGED_ACCOUNT, field='name')
+            form.set_error(errors.DEVELOPER_PRIVILEGED_ACCOUNT, 'name')
+            return
         if client.has_developer(account):
             c.errors.add(errors.DEVELOPER_ALREADY_ADDED, field='name')
             form.set_error(errors.DEVELOPER_ALREADY_ADDED, 'name')

r2/r2/lib/errors.py

@@ -139,6 +139,7 @@
         ('DEVELOPER_ALREADY_ADDED', _('already added')),
         ('TOO_MANY_DEVELOPERS', _('too many developers')),
         ('DEVELOPER_FIRST_PARTY_APP', _('this app can not be modified from this interface')),
+        ('DEVELOPER_PRIVILEGED_ACCOUNT', _('you cannot add this account from this interface')),
         ('INVALID_MODHASH', _("invalid modhash")),
         ('ALREADY_MODERATOR', _('that user is already a moderator')),
         ('CANT_RESTRICT_MODERATOR', _("You can't perform that action because that user is a moderator.")),

r2/r2/templates/prefapps.html

@@ -195,6 +195,7 @@ <h3>${app._id}</h3>
                 ${error_field('USER_DOESNT_EXIST', 'name')}
                 ${error_field('NO_USER', 'name')}
                 ${error_field('DEVELOPER_FIRST_PARTY_APP', 'name')}
+                ${error_field('DEVELOPER_PRIVILEGED_ACCOUNT', 'name')}
                 <span class="status"></span>
               </form>
             </td>