modified: web/blueprints/group_admin.py

modified:   web/blueprints/site_admin.py
	modified:   web/roles.py
	modified:   web/templates/admin/group_members.html

web/roles.py

@@ -20,6 +20,9 @@ GROUP_ROLE_OPTIONS = [
 GROUP_ROLE_SET = {role for role, _ in GROUP_ROLE_OPTIONS} | {"admin", "member"}
 GROUP_MANAGEMENT_ROLES = {"group_owner", "group_admin", "admin"}
 
+# Roles that only site admins may assign or revoke
+OWNER_ONLY_ROLES = {"group_owner"}
+
 
 def can_manage_group(role: str | None) -> bool:
     return role in GROUP_MANAGEMENT_ROLES