diff --git a/app/assets/locales/en.json b/app/assets/locales/en.json index 665d511926..553b17d250 100644 --- a/app/assets/locales/en.json +++ b/app/assets/locales/en.json @@ -452,7 +452,8 @@ "signin_required": "You must be signed in to access this page.", "malware_detected": "Malware Detected! The file you uploaded may contain malware. Please check your file and try again.", "roles": { - "role_assigned": "This role can't be deleted because it is assigned to at least one user." + "role_assigned": "This role can't be deleted because it is assigned to at least one user.", + "role_set_as_default": "This role can't be deleted because it is set as Default Role in Site Setting." }, "users": { "signup_error": "You can't be authenticated. Please contact your administrator.", diff --git a/app/controllers/api/v1/admin/roles_controller.rb b/app/controllers/api/v1/admin/roles_controller.rb index 4c4d1f43ed..2d2fdf893b 100644 --- a/app/controllers/api/v1/admin/roles_controller.rb +++ b/app/controllers/api/v1/admin/roles_controller.rb @@ -57,8 +57,15 @@ def create # POST /api/v1/:id/roles.json # Updates a role def update + old_role_name = @role.name + return render_error errors: @role.errors.to_a, status: :bad_request unless @role.update role_params + # update the 'DefaultRole' site setting value, if it used to be the current role. + default_role_site_setting = SiteSetting.joins(:setting).find_by(provider: current_provider, setting: { name: 'DefaultRole' }) + + default_role_site_setting.update(value: @role.name) if default_role_site_setting.value == old_role_name + render_data status: :ok end @@ -66,7 +73,15 @@ def update # Deletes a role def destroy undeletable_roles = %w[User Administrator Guest] - return render_error errors: @role.errors.to_a, status: :method_not_allowed if undeletable_roles.include?(@role.name) + if undeletable_roles.include?(@role.name) || User.find_by(role_id: @role.id) + return render_error errors: @role.errors.to_a, + status: :method_not_allowed + end + + # prevent role from being deleted if its the default role in site setting + default_role_site_setting = SiteSetting.joins(:setting).find_by(provider: current_provider, setting: { name: 'DefaultRole' }) + + return render_error status: :forbidden if default_role_site_setting.value == @role.name @role.destroy! diff --git a/app/javascript/hooks/mutations/admin/roles/useDeleteRole.jsx b/app/javascript/hooks/mutations/admin/roles/useDeleteRole.jsx index 471b5ba8ec..dac7a6db2e 100644 --- a/app/javascript/hooks/mutations/admin/roles/useDeleteRole.jsx +++ b/app/javascript/hooks/mutations/admin/roles/useDeleteRole.jsx @@ -31,6 +31,8 @@ export default function useDeleteRole({ role, onSettled }) { onError: (error) => { if (error.response?.status === 405) { toast.error(t('toast.error.roles.role_assigned')); + } else if (error.response?.status === 403) { + toast.error(t('toast.error.roles.role_set_as_default')); } else { toast.error(t('toast.error.problem_completing_action')); }