From b291ed43ca3632ecdff312d7cb271cf000f188e4 Mon Sep 17 00:00:00 2001
From: JustSong <quanpengsong@gmail.com>
Date: Fri, 28 Apr 2023 09:48:15 +0800
Subject: [PATCH] fix: check user's role when manage user

---
 controller/user.go | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/controller/user.go b/controller/user.go
index b50b249..7f7299e 100644
--- a/controller/user.go
+++ b/controller/user.go
@@ -600,6 +600,13 @@ func ManageUser(c *gin.Context) {
 			})
 			return
 		}
+		if user.Role == common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法禁用超级管理员用户",
+			})
+			return
+		}
 		channel.TokenStoreRemoveUser(&user)
 		user.Status = common.UserStatusDisabled
 	case "enable":
@@ -613,6 +620,13 @@ func ManageUser(c *gin.Context) {
 		channel.TokenStoreAddUser(&user)
 		user.Status = common.UserStatusEnabled
 	case "delete":
+		if user.Role == common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法删除超级管理员用户",
+			})
+			return
+		}
 		if err := user.Delete(); err != nil {
 			c.JSON(http.StatusOK, gin.H{
 				"success": false,
@@ -628,8 +642,29 @@ func ManageUser(c *gin.Context) {
 			})
 			return
 		}
+		if user.Role >= common.RoleAdminUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "该用户已经是管理员",
+			})
+			return
+		}
 		user.Role = common.RoleAdminUser
 	case "demote":
+		if user.Role == common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法降级超级管理员用户",
+			})
+			return
+		}
+		if user.Role == common.RoleCommonUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "该用户已经是普通用户",
+			})
+			return
+		}
 		user.Role = common.RoleCommonUser
 	case "allow_send_email_to_others":
 		user.SendEmailToOthers = common.SendEmailToOthersAllowed