MM-52638- Last admin cannot be demoted (#24087)

* don't allow last sysadmin to change roles

* cleanup, add comment

* only allow admin downgrade if more than one admin

* remove unused variable

* i18n-extract, unit test fixes

* Update user.go

* remove blank line

* update tests check all return values

* revert channel_store.go

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/app/user.go

@@ -1670,6 +1670,21 @@ func (a *App) UpdateUserRolesWithUser(c request.CTX, user *model.User, newRoles
 		return nil, err
 	}
 
+	if user.IsSystemAdmin() && !strings.Contains(newRoles, model.SystemAdminRoleId) {
+		// if user being updated is SysAdmin, make sure its not the last one.
+		options := model.UserCountOptions{
+			IncludeBotAccounts: false,
+			Roles:              []string{model.SystemAdminRoleId},
+		}
+		count, err := a.Srv().Store().User().Count(options)
+		if err != nil {
+			return nil, model.NewAppError("UpdateUserRoles", "app.user.update.countAdmins.app_error", nil, "", http.StatusBadRequest).Wrap(err)
+		}
+		if count <= 1 {
+			return nil, model.NewAppError("UpdateUserRoles", "app.user.update.lastAdmin.app_error", nil, "", http.StatusBadRequest)
+		}
+	}
+
 	user.Roles = newRoles
 	uchan := make(chan store.StoreResult[*model.UserUpdate], 1)
 	go func() {