diff options
| -rw-r--r-- | internal/api/handlers_admin.go | 4 | ||||
| -rw-r--r-- | internal/api/handlers_more_test.go | 1 |
2 files changed, 5 insertions, 0 deletions
diff --git a/internal/api/handlers_admin.go b/internal/api/handlers_admin.go index 77e5b9f..6d10c67 100644 --- a/internal/api/handlers_admin.go +++ b/internal/api/handlers_admin.go @@ -78,6 +78,10 @@ func (s *Server) handleDeleteUser(w http.ResponseWriter, r *http.Request) { return } id := pathID(r, "id") + if id == 0 { + badRequest(w, "invalid user id") + return + } adminUser, _ := r.Context().Value(userCtxKey).(*model.User) if adminUser != nil && adminUser.ID == id { badRequest(w, "cannot delete self") diff --git a/internal/api/handlers_more_test.go b/internal/api/handlers_more_test.go index a025524..57158fc 100644 --- a/internal/api/handlers_more_test.go +++ b/internal/api/handlers_more_test.go @@ -1731,6 +1731,7 @@ func TestServer_AdminDeleteUser(t *testing.T) { }{ {"nil service", "2", true, nil, http.StatusNotImplemented}, {"self delete", "1", false, nil, http.StatusBadRequest}, + {"invalid id zero", "0", false, nil, http.StatusBadRequest}, {"service error", "2", false, errors.New("boom"), http.StatusInternalServerError}, {"ok", "2", false, nil, http.StatusOK}, } |