hotfix(server): 自分自身の場合管理者権限を削除できないように #22

taiyme · Feb 18, 2023 · 2161ec0 · 2161ec0
1 parent bd43eb4
commit 2161ec0
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/packages/backend/src/server/api/endpoints/admin/admin/remove.ts b/packages/backend/src/server/api/endpoints/admin/admin/remove.ts
@@ -18,13 +18,17 @@ export const paramDef = {
 } as const;
 
 // eslint-disable-next-line import/no-default-export
-export default define(meta, paramDef, async (ps) => {
+export default define(meta, paramDef, async (ps, me) => {
 	const user = await Users.findOneBy({ id: ps.userId });
 
 	if (user == null) {
 		throw new Error('user not found');
 	}
 
+	if (user.id === me.id) {
+		throw new Error('cannot remove yourself');
+	}
+
 	await Users.update(user.id, {
 		isAdmin: false,
 	});