UFAL/Issue 1349: admin user is not allowed to delete himself/herself (ufal#1350) (#1306)

* Issue 1349: admin user is not allowed to delete himself/herself

* improve the fix: test context.getCurrentUser() for null

* throw IllegalStateException rather than AuthorizeException, and allow client to see the error message

(cherry picked from commit b913627)

Co-authored-by: Milan Kuchtiak <kuchtiak@ufal.mff.cuni.cz>
(cherry picked from commit 68463d4)

Author: 2 people

dspace-api/src/main/java/org/dspace/eperson/EPersonServiceImpl.java

@@ -380,6 +380,14 @@ public void delete(Context context, EPerson ePerson, boolean cascade)
             throw new AuthorizeException(
                     "You must be an admin to delete an EPerson");
         }
+        // Admin cannot delete himself/herself
+        if (!context.ignoreAuthorization()) {
+            EPerson currentUser = context.getCurrentUser();
+            if (currentUser != null && ePerson.getID().equals(currentUser.getID())) {
+                throw new IllegalStateException(
+                        "You, as admin user, cannot delete yourself");
+            }
+        }
         // Get all workflow-related groups that the current EPerson belongs to
         Set<Group> workFlowGroups = getAllWorkFlowGroups(context, ePerson);
         for (Group group: workFlowGroups) {

dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/EPersonRestRepository.java

@@ -376,7 +376,7 @@ protected void delete(Context context, UUID id) throws AuthorizeException {
         } catch (EmptyWorkflowGroupException e) {
             throw new RESTEmptyWorkflowGroupException(e);
         } catch (IllegalStateException e) {
-            throw new UnprocessableEntityException(e.getMessage(), e);
+            throw new DSpaceBadRequestException(e.getMessage(), e);
         }
     }
 

dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java

@@ -1099,6 +1099,20 @@ public void deleteForbidden() throws Exception {
                 .andExpect(status().isOk());
     }
 
+    @Test
+    public void deleteYourselfForbidden() throws Exception {
+        // login as admin
+        String adminToken = getAuthToken(admin.getEmail(), password);
+
+        // Deleting yourself is forbidden
+        getClient(adminToken).perform(delete("/api/eperson/epersons/" + admin.getID()))
+                .andExpect(status().isBadRequest());
+
+        // Verify the admin is still here
+        getClient(adminToken).perform(get("/api/eperson/epersons/" + admin.getID()))
+                .andExpect(status().isOk());
+    }
+
     @Test
     public void deleteViolatingWorkFlowConstraints() throws Exception {
         // We turn off the authorization system in order to create the structure as defined below