Add usecase - user should not be allowed to remove himself.
MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -14,6 +14,7 @@ import Site from '../../../../types/Site';
import SiteSecurity from './security/SiteSecurity';
import SiteStorage from '../../../../storage/mongodb/SiteStorage';
import TenantComponents from '../../../../types/TenantComponents';
+import { UserRole } from '../../../../types/User';
import UserStorage from '../../../../storage/mongodb/UserStorage';
import Utils from '../../../../utils/Utils';
import UtilsService from './UtilsService';
@@ -225,6 +226,16 @@ export default class SiteService {
user: req.user
});
}
+ // a non-admin user should now be allowed to unassign himself
+ if (filteredRequest.userIDs.includes(req.user.id) && action !== ServerAction.ADD_USERS_TO_SITE && req.user.role !== UserRole.ADMIN) {
+ throw new AppError({
+ source: Constants.CENTRAL_SERVER,
+ errorCode: HTTPError.GENERAL_ERROR,
+ message: 'The User is not allowed to remove himself',
+ module: MODULE_NAME, method: 'handleAssignUsersToSite',
+ user: req.user
+ });
+ }
// Check auth
if (!Authorizations.canReadSite(req.user)) {
throw new AppAuthError({

Add usecase - user should not be allowed to remove himself.