chore: throw error when adding permission for admin user

2025-12-11 03:34:35 +00:00 · 2022-06-24 23:19:19 +05:00
parent 907aa485fd
commit 35439d7d51
1 changed files with 4 additions and 0 deletions
--- a/api/src/controllers/permission.ts
+++ b/api/src/controllers/permission.ts
@@ -167,10 +167,14 @@ const createPermission = async ({
      const userInDB = await User.findOne({ id: principalId })
      if (!userInDB) throw new Error('User not found.')

+      if (userInDB.isAdmin)
+        throw new Error('Can not add permission for admin user.')
+
      const alreadyExists = await Permission.findOne({
        uri,
        user: userInDB._id
      })
+
      if (alreadyExists)
        throw new Error('Permission already exists with provided URI and User.')