Fixed admin - remove user

backend/app/api/admin.py

@@ -83,8 +83,11 @@ def create_user(payload: AdminUserCreate, _: dict = Depends(require_admin)):
 def update_user_privileges(
     user_id: str,
     payload: AdminUserUpdate,
-    _: dict = Depends(require_admin),
+    current_user: dict = Depends(require_admin),
 ):
+    if user_id == current_user['id']:
+        raise HTTPException(status_code=400, detail='You cannot change your own administrator status')
+
     with get_connection() as conn:
         target = conn.execute(
             'SELECT id, is_admin FROM users WHERE id = ?',
@@ -126,6 +129,9 @@ def delete_user(user_id: str, current_user: dict = Depends(require_admin)):
             if admins <= 1:
                 raise HTTPException(status_code=400, detail='Cannot delete the last administrator')
 
+        conn.execute('DELETE FROM tokens WHERE user_id = ?', (user_id,))
+        conn.execute('DELETE FROM user_plugin_config WHERE user_id = ?', (user_id,))
+        conn.execute('DELETE FROM links WHERE user_id = ?', (user_id,))
         conn.execute('DELETE FROM users WHERE id = ?', (user_id,))
         conn.commit()
     return {'status': 'deleted', 'id': user_id}

backend/tests/test_api.py

@@ -4,6 +4,7 @@
 import json
 import threading
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from uuid import uuid4
 
 from fastapi.testclient import TestClient
 
@@ -70,6 +71,38 @@ def test_admin_can_add_list_and_remove_users():
     assert client.delete(f"/api/admin/users/{user['id']}", headers=headers).status_code == 200
     assert all(item['id'] != user['id'] for item in client.get('/api/admin/users', headers=headers).json())
     assert client.delete('/api/admin/users/user-1', headers=headers).status_code == 400
+    assert client.put('/api/admin/users/user-1', headers=headers, json={'is_admin': False}).status_code == 400
+
+
+def test_admin_can_remove_user_with_owned_data():
+    headers = login_headers()
+    username = f'data-owner-{uuid4().hex}'
+    create_response = client.post('/api/admin/users', headers=headers, json={
+        'username': username,
+        'email': f'{username}@example.com',
+        'password': 'secret123',
+    })
+    assert create_response.status_code == 201
+    user_id = create_response.json()['id']
+    user_headers = login_headers(username)
+
+    link_response = client.post('/api/links', headers=user_headers, json={
+        'title': 'Owned link',
+        'url': 'https://example.com/owned',
+        'comment': 'Owned data',
+        'tags': ['owned'],
+    })
+    assert link_response.status_code == 201
+    label_response = client.post('/api/user/labels', headers=user_headers, json={'name': f'{username}-label'})
+    assert label_response.status_code == 201
+    plugin_response = client.put('/api/user/plugins/mastodon', headers=user_headers, json={
+        'instance': 'mastodon.social',
+    })
+    assert plugin_response.status_code == 200
+
+    removed = client.delete(f'/api/admin/users/{user_id}', headers=headers)
+    assert removed.status_code == 200
+    assert client.get('/api/auth/me', params={'token': user_headers['Authorization'].removeprefix('Bearer ')}).status_code == 401
 
 
 def test_admin_can_toggle_privileges_without_removing_last_admin():
@@ -277,7 +310,7 @@ def test_public_and_admin_pages_render_html():
     assert 'id="auth-menu" class="auth-menu hidden"' in admin_page
     assert 'id="auth-home-link" href="/">Home</a>' in admin_page
     assert '<a id="auth-username" class="user-name" href="/">' in admin_page
-    assert 'admin.js?v=3' in admin_page
+    assert 'admin.js?v=5' in admin_page
     feed_script = client.get('/static/feed.js?v=7').text
     assert 'if (item.is_owner)' in feed_script
     assert 'tag.toLowerCase() === pref.tag.toLowerCase()' in feed_script