From 3815b9d4c621e5ab10151a35a979377dcd49d01a Mon Sep 17 00:00:00 2001
From: Pig Fang <g-plane@hotmail.com>
Date: Thu, 1 Oct 2020 16:33:42 +0800
Subject: [PATCH] disallow admin to delete self (fix #229) (#233)

---
 .../src/views/admin/UsersManagement/Card.tsx   | 18 ++++++++++--------
 .../src/views/admin/UsersManagement/Row.tsx    |  2 +-
 .../tests/views/admin/UsersManagement.test.tsx |  4 ++--
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/resources/assets/src/views/admin/UsersManagement/Card.tsx b/resources/assets/src/views/admin/UsersManagement/Card.tsx
index e3ff5402..55576383 100644
--- a/resources/assets/src/views/admin/UsersManagement/Card.tsx
+++ b/resources/assets/src/views/admin/UsersManagement/Card.tsx
@@ -103,14 +103,16 @@ const Card: React.FC<Props> = (props) => {
                     {t('admin.toggleVerification')}
                   </a>
                   <div className="dropdown-divider"></div>
-                  <a
-                    href="#"
-                    className="dropdown-item dropdown-item-danger"
-                    onClick={props.onDelete}
-                  >
-                    <i className="fas fa-trash mr-2"></i>
-                    {t('admin.deleteUser')}
-                  </a>
+                  {canModify && user.uid !== currentUser.uid && (
+                    <a
+                      href="#"
+                      className="dropdown-item dropdown-item-danger"
+                      onClick={props.onDelete}
+                    >
+                      <i className="fas fa-trash mr-2"></i>
+                      {t('admin.deleteUser')}
+                    </a>
+                  )}
                 </div>
               </div>
             )}
diff --git a/resources/assets/src/views/admin/UsersManagement/Row.tsx b/resources/assets/src/views/admin/UsersManagement/Row.tsx
index d2ef64e1..9d11760d 100644
--- a/resources/assets/src/views/admin/UsersManagement/Row.tsx
+++ b/resources/assets/src/views/admin/UsersManagement/Row.tsx
@@ -101,7 +101,7 @@ const Row: React.FC<Props> = (props) => {
         </button>
         <button
           className="btn btn-danger"
-          disabled={!canModify}
+          disabled={!canModify || user.uid === currentUser.uid}
           onClick={props.onDelete}
         >
           {t('admin.deleteUser')}
diff --git a/resources/assets/tests/views/admin/UsersManagement.test.tsx b/resources/assets/tests/views/admin/UsersManagement.test.tsx
index 34d5ccf6..39644b9b 100644
--- a/resources/assets/tests/views/admin/UsersManagement.test.tsx
+++ b/resources/assets/tests/views/admin/UsersManagement.test.tsx
@@ -221,7 +221,7 @@ describe('access control', () => {
     expect(queryByText(t('admin.changeScore'))).toBeInTheDocument()
     expect(queryByText(t('admin.changePermission'))).not.toBeInTheDocument()
     expect(queryByText(t('admin.toggleVerification'))).toBeInTheDocument()
-    expect(queryByText(t('admin.deleteUser'))).toBeInTheDocument()
+    expect(queryByText(t('admin.deleteUser'))).not.toBeInTheDocument()
 
     fireEvent.click(getByTitle('Table Mode'))
     expect(queryByTitle(t('admin.changeEmail'))).toBeInTheDocument()
@@ -230,7 +230,7 @@ describe('access control', () => {
     expect(queryByTitle(t('admin.changePermission'))).not.toBeInTheDocument()
     expect(queryByTitle(t('admin.toggleVerification'))).toBeInTheDocument()
     expect(getByText(t('admin.changePassword'))).toBeEnabled()
-    expect(getByText(t('admin.deleteUser'))).toBeEnabled()
+    expect(getByText(t('admin.deleteUser'))).toBeDisabled()
   })
 })