admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-17 18:12:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): Do not allow admins to delete the instance owner (#9489)

Browse Source
This commit is contained in:
कारतोफ्फेलस्क्रिप्ट™
2024-05-22 16:23:40 +02:00
committed by GitHub
parent 88b9a4070b
commit fc83005ba0
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/cli/src/controllers/users.controller.ts
View File

@@ -168,6 +168,10 @@ export class UsersController {
); );
} }
if (userToDelete.role === 'global:owner') {
throw new ForbiddenError('Instance owner cannot be deleted.');
}
const personalProjectToDelete = await this.projectRepository.getPersonalProjectForUserOrFail( const personalProjectToDelete = await this.projectRepository.getPersonalProjectForUserOrFail(
userToDelete.id, userToDelete.id,
); );

9
packages/cli/test/integration/users.api.test.ts
View File

@@ -582,6 +582,15 @@ describe('DELETE /users/:id', () => {
expect(user).toBeDefined(); expect(user).toBeDefined();
}); });
test('should fail to delete the instance owner', async () => {
const admin = await createAdmin();
const adminAgent = testServer.authAgentFor(admin);
await adminAgent.delete(`/users/${owner.id}`).expect(403);
const user = await getUserById(owner.id);
expect(user).toBeDefined();
});
test('should fail to delete a user that does not exist', async () => { test('should fail to delete a user that does not exist', async () => {
await ownerAgent.delete(`/users/${uuid()}`).query({ transferId: '' }).expect(404); await ownerAgent.delete(`/users/${uuid()}`).query({ transferId: '' }).expect(404);
}); });