From af09a8ad94bfeddd1f7ccfad3aacab1332f915c9 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sun, 10 May 2026 09:51:31 +0300
Subject: api: reject id==0 in handleDeleteUser to avoid 200 OK for invalid
 path

---
 internal/api/handlers_admin.go | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'internal/api/handlers_admin.go')

diff --git a/internal/api/handlers_admin.go b/internal/api/handlers_admin.go
index 77e5b9f..6d10c67 100644
--- a/internal/api/handlers_admin.go
+++ b/internal/api/handlers_admin.go
@@ -78,6 +78,10 @@ func (s *Server) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	id := pathID(r, "id")
+	if id == 0 {
+		badRequest(w, "invalid user id")
+		return
+	}
 	adminUser, _ := r.Context().Value(userCtxKey).(*model.User)
 	if adminUser != nil && adminUser.ID == id {
 		badRequest(w, "cannot delete self")
-- 
cgit v1.2.3