explicitly prevent deletion of admin user

This commit is contained in:
Josh Hawkins 2025-11-26 07:12:00 -06:00
parent 113365b911
commit ea217bdbac

View File

@ -579,7 +579,13 @@ def create_user(
@router.delete("/users/{username}", dependencies=[Depends(require_role(["admin"]))])
def delete_user(username: str):
def delete_user(request: Request, username: str):
# Prevent deletion of the built-in admin user
if username == "admin":
return JSONResponse(
content={"message": "Cannot delete admin user"}, status_code=403
)
User.delete_by_id(username)
return JSONResponse(content={"success": True})