ExternalVendorCode/chirpstack
1
0
Fork 0
mirror of https://github.com/chirpstack/chirpstack.git synced 2025-05-07 03:18:25 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

User should not be able to delete its own user record. (#13)

Browse Source 
Signed-off-by: SAGAR PATEL <sagar.a.patel@slscorp.com>
This commit is contained in:
SAGAR PATEL 2022-06-07 16:23:23 +05:30 committed by GitHub
parent ba4aeb849c
commit d1630e5722
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
chirpstack/src/api/tenant.rs
View File

@ -334,6 +334,15 @@ impl TenantService for Tenant {
) )
.await?; .await?;
let auth_id = request.extensions().get::<AuthID>().unwrap();
if let AuthID::User(id) = auth_id {
if id == &user_id {
return Err(Status::invalid_argument(
"you can not delete yourself from the user",
));
}
}
tenant::delete_user(&tenant_id, &user_id) tenant::delete_user(&tenant_id, &user_id)
.await .await
.map_err(|e| e.status())?; .map_err(|e| e.status())?;

19
chirpstack/src/api/user.rs
View File

@ -7,7 +7,7 @@ use uuid::Uuid;
use chirpstack_api::api; use chirpstack_api::api;
use chirpstack_api::api::user_service_server::UserService; use chirpstack_api::api::user_service_server::UserService;
use super::auth::validator; use super::auth::{validator, AuthID};
use super::error::ToStatus; use super::error::ToStatus;
use super::helpers; use super::helpers;
use crate::storage::{tenant, user}; use crate::storage::{tenant, user};
@ -158,6 +158,15 @@ impl UserService for User {
) )
.await?; .await?;
let auth_id = request.extensions().get::<AuthID>().unwrap();
if let AuthID::User(id) = auth_id {
if id == &user_id {
return Err(Status::invalid_argument(
"you can not delete yourself from the user",
));
}
}
user::delete(&user_id).await.map_err(|e| e.status())?; user::delete(&user_id).await.map_err(|e| e.status())?;
Ok(Response::new(())) Ok(Response::new(()))
@ -359,5 +368,13 @@ pub mod test {
del_req.extensions_mut().insert(AuthID::User(u.id.clone())); del_req.extensions_mut().insert(AuthID::User(u.id.clone()));
let del_resp = service.delete(del_req).await; let del_resp = service.delete(del_req).await;
assert!(del_resp.is_err()); assert!(del_resp.is_err());
let del_req = api::DeleteUserRequest {
id: u.id.to_string(),
};
let mut del_req = Request::new(del_req);
del_req.extensions_mut().insert(AuthID::User(u.id.clone()));
let del_resp = service.delete(del_req).await;
assert!(del_resp.is_err());
} }
} }