fix(api): check groups on user deletion (#6401)

ovh · Jan 2, 2023 · 0da638e · 0da638e
1 parent b29d61c
commit 0da638e
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/engine/api/user.go b/engine/api/user.go
@@ -2,9 +2,10 @@ package api
 
 import (
 	"context"
-	"github.com/ovh/cds/engine/api/organization"
 	"net/http"
 
+	"github.com/ovh/cds/engine/api/organization"
+
 	"github.com/gorilla/mux"
 	"github.com/lib/pq"
 
@@ -234,7 +235,7 @@ func (api *API) deleteUserHandler() service.Handler {
 		}
 		for i := range gus {
 			if gus[i].Admin {
-				adminGroupIDs = append(adminGroupIDs, gus[i].ID)
+				adminGroupIDs = append(adminGroupIDs, gus[i].GroupID)
 			}
 		}
 		if len(adminGroupIDs) > 0 {

diff --git a/engine/api/user_test.go b/engine/api/user_test.go
@@ -3,11 +3,12 @@ package api
 import (
 	"context"
 	"encoding/json"
-	"github.com/ovh/cds/engine/api/organization"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
+	"github.com/ovh/cds/engine/api/organization"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -229,6 +230,7 @@ func Test_deleteUserHandler(t *testing.T) {
 
 	initial1, jwtInitial1Raw := assets.InsertLambdaUser(t, db)
 	initial2, _ := assets.InsertLambdaUser(t, db)
+	initial3, _ := assets.InsertLambdaUser(t, db, &sdk.Group{Name: sdk.RandomString(10)})
 	admin1, jwtAdmin1Raw := assets.InsertAdminUser(t, db)
 	admin2, _ := assets.InsertAdminUser(t, db)
 
@@ -262,6 +264,12 @@ func Test_deleteUserHandler(t *testing.T) {
 			TargetUsername: admin1.Username,
 			ExpectedStatus: http.StatusForbidden,
 		},
+		{
+			Name:           "A user can be removed if last admin of a group",
+			JWT:            jwtAdmin1Raw,
+			TargetUsername: initial3.Username,
+			ExpectedStatus: http.StatusForbidden,
+		},
 	}
 
 	for _, c := range cases {