Fixes to roles_controller update & delete action. Changes need to be reflected in SiteSetting DefaultRole setting.

app/assets/locales/en.json

@@ -452,7 +452,8 @@
       "signin_required": "You must be signed in to access this page.",
       "malware_detected": "Malware Detected! The file you uploaded may contain malware. Please check your file and try again.",
       "roles": {
-        "role_assigned": "This role can't be deleted because it is assigned to at least one user."
+        "role_assigned": "This role can't be deleted because it is assigned to at least one user.",
+        "role_set_as_default": "This role can't be deleted because it is set as Default Role in Site Setting."
       },
       "users": {
         "signup_error": "You can't be authenticated. Please contact your administrator.",

app/controllers/api/v1/admin/roles_controller.rb

@@ -57,16 +57,31 @@ def create
         # POST /api/v1/:id/roles.json
         # Updates a role
         def update
+          old_role_name = @role.name
+
           return render_error errors: @role.errors.to_a, status: :bad_request unless @role.update role_params
 
+          # update the 'DefaultRole' site setting value, if it used to be the current role.
+          default_role_site_setting = SiteSetting.joins(:setting).find_by(provider: current_provider, setting: { name: 'DefaultRole' })
+
+          default_role_site_setting.update(value: @role.name) if default_role_site_setting.value == old_role_name
+
           render_data status: :ok
         end
 
         # DELETE /api/v1/admin/roles.json
         # Deletes a role
         def destroy
           undeletable_roles = %w[User Administrator Guest]
-          return render_error errors: @role.errors.to_a, status: :method_not_allowed if undeletable_roles.include?(@role.name)
+          if undeletable_roles.include?(@role.name) || User.find_by(role_id: @role.id)
+            return render_error errors: @role.errors.to_a,
+                                status: :method_not_allowed
+          end
+
+          # prevent role from being deleted if its the default role in site setting
+          default_role_site_setting = SiteSetting.joins(:setting).find_by(provider: current_provider, setting: { name: 'DefaultRole' })
+
+          return render_error status: :forbidden if default_role_site_setting.value == @role.name
 
           @role.destroy!
 

app/javascript/hooks/mutations/admin/roles/useDeleteRole.jsx

@@ -31,6 +31,8 @@ export default function useDeleteRole({ role, onSettled }) {
       onError: (error) => {
         if (error.response?.status === 405) {
           toast.error(t('toast.error.roles.role_assigned'));
+        } else if (error.response?.status === 403) {
+          toast.error(t('toast.error.roles.role_set_as_default'));
         } else {
           toast.error(t('toast.error.problem_completing_action'));
         }