VSB-TUO/Prevent an admin from deleting their own account - #1445
Merged
milanmajchrak merged 4 commits intoAug 14, 2026
Conversation
…ministration page (#1335) * 117 better control of user deletion in user administration page (ufal#140) * Disable self-delete and add delete warnings Prevent administrators from deleting their own account by disabling the delete button for the current authenticated user and showing a tooltip. Add a warningLabel input to the confirmation modal and render it when present. Implement logic in EPeopleRegistryComponent to determine the current user, compute a contextual delete warning (submitter, admin, or both) by querying workspace/workflow submissions, search, and group membership, and open the confirmation modal with that warning. Handle delete responses to show a friendly notification for backend 400 self-delete errors and use a generic failure notification otherwise. Update templates, component imports and helper methods (isCurrentUser, getDeleteWarningLabel, hasSubmittedItems, isAdministrator, isSelfDeletionError, showSelfDeleteNotification), and extend unit tests to cover disabled self-delete UI, composed warning labels, and notification behavior. * Prevent self-delete and show delete warnings Disable direct self-deletion and surface contextual warnings when deleting an EPerson. Template: render the delete button as disabled for the currently authenticated user and show a tooltip explaining self-delete restrictions; otherwise show the normal delete button. Component: track the current authenticated user, compute a combined warning label based on whether the EPerson is an administrator and/or has submitted items (checks workspace, workflow and archived submissions), present that warning in the confirmation modal, and handle deletion results including a friendly notification for backend self-delete errors. Added helper methods (isCurrentUser, getDeleteWarningLabel, hasSubmittedItems, isAdministrator, isSelfDeletionError, showSelfDeleteNotification) and adjusted delete flow to update canDelete$ appropriately. Tests: updated and added specs and mocks to cover the disabled self-delete UI, combined warning label usage, and the friendly self-delete error notification; added required service mocks and test setup changes. * Add EPerson delete warnings and self-delete message Add four i18n keys to en.json5 and cs.json5 for EPerson deletion flows: a forbidden self-delete message and warnings for deleting users who are submitters, administrators, or both. Provides localized English and Czech strings to surface these messages in the admin access-control UI. * Guard EPerson delete until auth ID resolved Prevent delete actions from running before the current authenticated user id is available. Add a template condition to hide the delete button until currentAuthenticatedUserId is set, add an early-return guard in deleteEPerson when the id is missing, and add a unit test ensuring the modal is not opened and delete is not called before the id is resolved. * Hide delete button until auth user ID resolved Prevent delete actions before the current authenticated user ID is available. Add *ngIf to the delete button in the template, add an early return guard in the component's delete flow when currentAuthenticatedUserId is not set, and include unit tests verifying the button is hidden and the delete/modal are not invoked until the ID is resolved. * Restrict delete button visibility and update tests Template: Wrap self-delete tooltip/button in a guard that checks epersonDto.ableToDelete and currentAuthenticatedUserId so delete UI is only rendered when deletion is allowed; simplify the enabledDeleteButton markup by removing a duplicated *ngIf on the inner button. Spec: remove unused DebugElement import, rename the test from 'should be disabled' to 'should be hidden', and update assertions to expect no delete buttons to be present (reflecting the new visibility behavior). * Detect Administrator group across paginated pages Add support for detecting Administrator group membership across paginated group lists and a unit test for it. - Introduce hasAdministratorGroupOnPage(groupsHref, currentPage) which fetches group pages (elementsPerPage=100) and recursively checks subsequent pages when the Administrator group is not found on the current page. - isAdministrator now delegates to hasAdministratorGroupOnPage starting at page 1. - Preserve error handling to return false on failures. - Add a unit test that simulates a two-page group response (administrator present on the second page) and verifies the component detects administrator membership and displays the correct warning label. * Detect Administrator group across pages Refactor group membership check to traverse paginated group lists until an "Administrator" group is found or pages are exhausted. Introduces a recursive hasAdministratorGroupOnPage that requests pages, validates payload/pageInfo, checks for the admin group, and requests the next page when needed. Adds a unit test covering detection on later pages and a minor spec setup tweak (setting currentAuthenticatedUserId) to correctly exercise deletion behavior. * Fix Czech typo in delete warning Corrects a spelling mistake in src/assets/i18n/cs.json5 for key admin.access-control.epeople.delete.warning.submitter: changed 'repositáři' to 'repozitáři' to improve Czech translation accuracy. * Make disabled delete button unfocusable Add tabindex="-1" to the disabled delete button in the epeople registry template so it cannot receive keyboard focus. This ensures the parent span (which provides the tooltip) remains the sole focus target for the current-user case, improving accessibility and preventing duplicate focusable elements. * Make disabled self-delete button unfocusable Add tabindex="-1" to the disabled delete button in eperson-form.component.html so the button cannot receive keyboard focus when showing the current user. The tooltip remains on the parent span, improving keyboard navigation and accessibility for the self-delete warning. * Remove stray 'after' attribute from eperson template Remove an unintended "after" attribute from a <span> in eperson-form.component.html. The change cleans up the template by leaving only the intended *ngIf binding for conditional rendering of the delete/impersonation UI, preventing potential template parsing or linting issues. * code cleanup - remove duplicities * cleanup * copilot comments * copilot's comment --------- Co-authored-by: Ondrej Kosarko <kosarko@ufal.mff.cuni.cz> (cherry picked from commit d0b5ecf) * fix(access-control): quote submitter UUID in archived item search query --------- Co-authored-by: Amad Ul Hassan <hassan@ufal.mff.cuni.cz> (cherry picked from commit 07957d8)
…1357) * Fix misleading message when self-delete rejection lacks a matched error text isSelfDeletionError() matches the backend's rejection message as plain text, but Spring Boot omits exception messages from error response bodies by default and DSpaceBadRequestException/IllegalStateException have no dedicated JSON-body exception handler, so the match can silently fail and fall through to the generic, unfriendly failure notification instead of the "you cannot delete your own account" one. Add a deterministic client-side identity check as a fallback alongside the text match so the friendly message shows reliably regardless of what the backend's error body contains. Fixes dataquest-dev/dspace-customers#782 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Removed redundant comments --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Matus Kasak <matus.kasak@dataquest.sk> (cherry picked from commit 43cf493)
The disabled delete button's ngbTooltip renders inside the table's .table-responsive wrapper, which has overflow-x: auto — clipping the tooltip popover since the button sits near the table's right edge. Add container="body" so the tooltip is appended to <body> instead, escaping the overflow-clipped ancestor (same convention already used elsewhere in this codebase, e.g. health-status and orcid-queue). Fixes dataquest-dev/dspace-customers#800 Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> (cherry picked from commit 96209c4)
Kasinhou
changed the title
Rewrites the four Czech strings for the self-delete guard so they read
naturally rather than as literal translations, keeping the repository's
established Czech terminology (uživatel / správce / záznamy / smazat) and
active phrasing ("Jeho smazáním odeberete…" instead of the nominal
"Smazání tohoto uživatele odebere…"). Wording is identical across all
customer branches. Raised in review on PR #1447.
Refs dataquest-dev/dspace-customers#855
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of the UFAL self-delete guard from
dtq-devontocustomer/vsb-tuo— #1335 (the feature), #1357 (friendly rejection notification) and #1373 (tooltip clipped by the table).What changes
warningLabelinput onConfirmationModalComponent.EPersonDeleteGuardServiceso the registry and the form stay in sync.Branch-specific notes
Clean cherry-pick of all three source commits — this branch is the same 7.6.5 family as
dtq-dev.Verified locally (Node 22):
ng test --include='src/app/access-control/epeople-registry/**/*.spec.ts'and--include='src/app/shared/confirmation-modal/**/*.spec.ts'all green;eslinton the changed files reports 0 errors.Backend counterpart: dataquest-dev/DSpace#1400 — the two must ship together.
Refs dataquest-dev/dspace-customers#855
How this was verified
Manual — on a live instance (JCU 9.3 pair)
Throwaway stack: backend built from the paired branch
jcu/be-forbid-admin-self-delete(REST on :8091,own DB / Solr), frontend served from the branch under test, logged in as an administrator.
204and the account was gone (404) — the bug in issue #855, reproduced.container="body"part of #1373).Automated
Locally on this branch (Node 22):
ng test --include='src/app/access-control/epeople-registry/**/*.spec.ts'→ 55 tests, 0 failures;--include='src/app/shared/confirmation-modal/**/*.spec.ts'→ 13 tests, 0 failures;eslinton the changed files → 0 errors.The CI
testsjob runs lint plus the full unit suite on this PR.The live run was on the JCU 9.3 pair. VSB-TUO was not exercised in a browser; it is the only branch that took all three source commits as a clean cherry-pick (same 7.6.5 family as
dtq-dev), and its unit tests are green.Live UI screenshots
Captured live in a browser (7.6.5 FE against a matching DSpace 7.6.5 backend): logged in as an administrator, opened
Access Control → EPeople. The admin's own row is the first one.
Before — the own row's Delete button is enabled/clickable (the bug).
After — the own row's Delete button is disabled and shows the tooltip "You cannot delete your own EPerson account."; other rows stay enabled.
