fix(core): Do not allow admins to delete the instance owner (#9489)

This commit is contained in:
कारतोफ्फेलस्क्रिप्ट™ 2024-05-22 16:23:40 +02:00 committed by GitHub
parent 88b9a4070b
commit fc83005ba0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 0 deletions

View file

@ -168,6 +168,10 @@ export class UsersController {
);
}
if (userToDelete.role === 'global:owner') {
throw new ForbiddenError('Instance owner cannot be deleted.');
}
const personalProjectToDelete = await this.projectRepository.getPersonalProjectForUserOrFail(
userToDelete.id,
);

View file

@ -582,6 +582,15 @@ describe('DELETE /users/:id', () => {
expect(user).toBeDefined();
});
test('should fail to delete the instance owner', async () => {
const admin = await createAdmin();
const adminAgent = testServer.authAgentFor(admin);
await adminAgent.delete(`/users/${owner.id}`).expect(403);
const user = await getUserById(owner.id);
expect(user).toBeDefined();
});
test('should fail to delete a user that does not exist', async () => {
await ownerAgent.delete(`/users/${uuid()}`).query({ transferId: '' }).expect(404);
});