admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4692 - the SuperUser account can not be deleted

Browse Source 
UserBiz.ValidateCanDelete refused a delete only when the user had related
records, so SuperUser with none could be deleted and nothing could bring it
back. User 1 is now refused (2004) before any other check. Changelog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-25 20:18:39 -07:00
parent b116034dc9
commit a53a4b6ef7
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
server/AyaNova/biz/UserBiz.cs
View File

@@ -1093,6 +1093,13 @@ namespace AyaNova.Biz
//Can delete?
private async Task ValidateCanDelete(User inObj)
{
//case 4692: the SuperUser account is never deleted; nothing could bring it back (AYANOVA_SET_SUPERUSER_PW only
//resets the password of an existing one)
if (inObj.Id == 1)
{
AddError(ApiErrorCode.NOT_AUTHORIZED, "generalerror", "The SuperUser account can not be deleted");
return;
}
//FOREIGN KEY CHECKS
if (await ct.Memo.AnyAsync(m => m.ToId == inObj.Id || m.FromId == inObj.Id))