diff --git a/dspace-api/src/main/java/org/dspace/eperson/EPersonServiceImpl.java b/dspace-api/src/main/java/org/dspace/eperson/EPersonServiceImpl.java index 453d5d0726be..4370ff4998fd 100644 --- a/dspace-api/src/main/java/org/dspace/eperson/EPersonServiceImpl.java +++ b/dspace-api/src/main/java/org/dspace/eperson/EPersonServiceImpl.java @@ -376,6 +376,14 @@ public void delete(Context context, EPerson ePerson, boolean cascade) throw new AuthorizeException( "You must be an admin to delete an EPerson"); } + // Admin cannot delete himself/herself + if (!context.ignoreAuthorization()) { + EPerson currentUser = context.getCurrentUser(); + if (currentUser != null && ePerson.getID().equals(currentUser.getID())) { + throw new IllegalStateException( + "You, as admin user, cannot delete yourself"); + } + } // Get all workflow-related groups that the current EPerson belongs to Set workFlowGroups = getAllWorkFlowGroups(context, ePerson); for (Group group: workFlowGroups) { diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/EPersonRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/EPersonRestRepository.java index b213b6d1eabb..1d4b95459647 100644 --- a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/EPersonRestRepository.java +++ b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/EPersonRestRepository.java @@ -375,7 +375,7 @@ protected void delete(Context context, UUID id) throws AuthorizeException { } catch (EmptyWorkflowGroupException e) { throw new RESTEmptyWorkflowGroupException(e); } catch (IllegalStateException e) { - throw new UnprocessableEntityException(e.getMessage(), e); + throw new DSpaceBadRequestException(e.getMessage(), e); } } diff --git a/dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java b/dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java index e1febcfa0fe0..7dc817a5cdc2 100644 --- a/dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java +++ b/dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java @@ -1126,6 +1126,20 @@ public void deleteForbidden() throws Exception { .andExpect(status().isOk()); } + @Test + public void deleteYourselfForbidden() throws Exception { + // login as admin + String adminToken = getAuthToken(admin.getEmail(), password); + + // Deleting yourself is forbidden + getClient(adminToken).perform(delete("/api/eperson/epersons/" + admin.getID())) + .andExpect(status().isBadRequest()); + + // Verify the admin is still here + getClient(adminToken).perform(get("/api/eperson/epersons/" + admin.getID())) + .andExpect(status().isOk()); + } + @Test public void deleteViolatingWorkFlowConstraints() throws Exception { // We turn off the authorization system in order to create the structure as defined below