Merge pull request #188 from crupest/root-user

Forbid some operation on root user.

1 files changed, 21 insertions, 5 deletions

diff --git a/BackEnd/Timeline/Controllers/UserController.cs b/BackEnd/Timeline/Controllers/UserController.cs
index bbdb5d57..8edae139 100644
--- a/BackEnd/Timeline/Controllers/UserController.cs
+++ b/BackEnd/Timeline/Controllers/UserController.cs
@@ -138,15 +138,23 @@ namespace Timeline.Controllers
         /// <returns>Info of deletion.</returns>

         [HttpDelete("users/{username}"), PermissionAuthorize(UserPermission.UserManagement)]

         [ProducesResponseType(StatusCodes.Status200OK)]

+        [ProducesResponseType(StatusCodes.Status400BadRequest)]

         [ProducesResponseType(StatusCodes.Status401Unauthorized)]

         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult<CommonDeleteResponse>> Delete([FromRoute][Username] string username)

         {

-            var delete = await _userDeleteService.DeleteUser(username);

-            if (delete)

-                return Ok(CommonDeleteResponse.Delete());

-            else

-                return Ok(CommonDeleteResponse.NotExist());

+            try

+            {

+                var delete = await _userDeleteService.DeleteUser(username);

+                if (delete)

+                    return Ok(CommonDeleteResponse.Delete());

+                else

+                    return Ok(CommonDeleteResponse.NotExist());

+            }

+            catch (InvalidOperationOnRootUserException)

+            {

+                return BadRequest(ErrorResponse.UserController.Delete_RootUser());

+            }

         }

 

         /// <summary>

@@ -212,6 +220,10 @@ namespace Timeline.Controllers
             {

                 return NotFound(ErrorResponse.UserCommon.NotExist());

             }

+            catch (InvalidOperationOnRootUserException)

+            {

+                return BadRequest(ErrorResponse.UserController.ChangePermission_RootUser());

+            }

         }

 

         [HttpDelete("users/{username}/permissions/{permission}"), PermissionAuthorize(UserPermission.UserManagement)]

@@ -232,6 +244,10 @@ namespace Timeline.Controllers
             {

                 return NotFound(ErrorResponse.UserCommon.NotExist());

             }

+            catch (InvalidOperationOnRootUserException)

+            {

+                return BadRequest(ErrorResponse.UserController.ChangePermission_RootUser());

+            }

         }

     }

 }