fix(api): allow server owner to delete other admin accounts

4 years ago · 2ac6fe7f6d
parent 2a869f74eb
commit 2ac6fe7f6d
1 changed files with 1 additions and 1 deletions
--- a/server/routes/user/index.ts
+++ b/server/routes/user/index.ts
@ -281,7 +281,7 @@ router.delete<{ id: string }>(
        });
      }

-      if (user.hasPermission(Permission.ADMIN)) {
+      if (user.hasPermission(Permission.ADMIN) && req.user?.id !== 1) {
        return next({
          status: 405,
          message: 'You cannot delete users with administrative privileges.',