forked from fixin.me/fixin.me
Prevent sole admin from deleting their account
Without this guard, the last admin in the system could delete their own account, making the application unmanageable. This adds a model method `User#sole_admin?`, a controller guard in `RegistrationsController#destroy`, and disables the delete button in the profile edit view when the current user is the only remaining admin. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -2,7 +2,11 @@ class RegistrationsController < Devise::RegistrationsController
|
||||
before_action :authenticate_user!, only: [:edit, :update, :destroy]
|
||||
|
||||
def destroy
|
||||
# TODO: Disallow/disable deletion for last admin account; update :edit view
|
||||
if current_user.sole_admin?
|
||||
redirect_back fallback_location: edit_user_registration_path,
|
||||
alert: t(".sole_admin")
|
||||
return
|
||||
end
|
||||
super
|
||||
end
|
||||
|
||||
|
||||
Reference in New Issue
Block a user