Prevent admin users from deleting their own account?

[dennisvang]

Admin users can delete their own account or change their role from admin to user.

If you're the only admin, this means you can lock yourself out.

Would it be helpful to ensure there always remains at least one admin account, by preventing the last admin user from deleting their account or changing role to non-admin?

[mihailefter]

Good point. Should this be enforced only in the client, or should the backend also reject it?

A client side guard would be easy to add as a UI convenience, but anyone calling the API directly could bypass it.

[dennisvang]

@mihailefter You're right, perhaps we should enforce this on the back-end.

We could return something like a status 409 "Conflict" because the request violates a business rule (there must be at least one admin user account).

The fdp-ui could then simply handle that status code.

[dennisvang]

Anyway this is low priority right now.