mudhorn/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2024-12-24 20:24:05 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(core): Do not allow admins to delete the instance owner (#9489)

Browse source
This commit is contained in:
कारतोफ्फेलस्क्रिप्ट™ 2024-05-22 16:23:40 +02:00 committed by GitHub
parent 88b9a4070b
commit fc83005ba0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
packages/cli/src/controllers/users.controller.ts
View file

@ -168,6 +168,10 @@ export class UsersController {
); );
} }
if (userToDelete.role === 'global:owner') {
throw new ForbiddenError('Instance owner cannot be deleted.');
}
const personalProjectToDelete = await this.projectRepository.getPersonalProjectForUserOrFail( const personalProjectToDelete = await this.projectRepository.getPersonalProjectForUserOrFail(
userToDelete.id, userToDelete.id,
); );

9
packages/cli/test/integration/users.api.test.ts
View file

@ -582,6 +582,15 @@ describe('DELETE /users/:id', () => {
expect(user).toBeDefined(); expect(user).toBeDefined();
}); });
test('should fail to delete the instance owner', async () => {
const admin = await createAdmin();
const adminAgent = testServer.authAgentFor(admin);
await adminAgent.delete(`/users/${owner.id}`).expect(403);
const user = await getUserById(owner.id);
expect(user).toBeDefined();
});
test('should fail to delete a user that does not exist', async () => { test('should fail to delete a user that does not exist', async () => {
await ownerAgent.delete(`/users/${uuid()}`).query({ transferId: '' }).expect(404); await ownerAgent.delete(`/users/${uuid()}`).query({ transferId: '' }).expect(404);
}); });