From 5537cf0608d422df832c5e7c52a1a70a69a99112 Mon Sep 17 00:00:00 2001 From: Abin Simon Date: Thu, 14 Apr 2022 16:24:44 +0530 Subject: [PATCH] Don't allow users to delete builtin roles --- pkg/service/role.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/service/role.go b/pkg/service/role.go index 06daac6..55ad9d5 100644 --- a/pkg/service/role.go +++ b/pkg/service/role.go @@ -315,6 +315,9 @@ func (s *roleService) Delete(ctx context.Context, role *rolev3.Role) (*rolev3.Ro } if rle, ok := entity.(*models.Role); ok { + if rle.Builtin { + return role, fmt.Errorf("builtin role '%v' cannot be deleted", name) + } tx, err := s.db.BeginTx(ctx, &sql.TxOptions{}) if err != nil {