Merge pull request #2566 from richard-cox/block-delete-self

Ensure current user cannot deactivate or delete themselves

models/management.cattle.io.user.js

@@ -11,6 +11,12 @@ export default {
     return false;
   },
 
+  isCurrentUser() {
+    const currentPrincipal = this.$rootGetters['auth/principalId'];
+
+    return !!this.principalIds.find(p => p === currentPrincipal);
+  },
+
   nameDisplay() {
     return this.displayName || this.username || this.id;
   },
@@ -136,10 +142,14 @@ export default {
       const stateOk = state ? this.state === 'inactive' : this.state === 'active';
       const permissionOk = this.hasLink('update'); // Not canUpdate, only gate on api not whether editable pages should be visible
 
-      return stateOk && permissionOk;
+      return stateOk && permissionOk && !this.isCurrentUser;
     };
   },
 
+  canDelete() {
+    return this._canDelete && !this.isCurrentUser;
+  },
+
   _availableActions() {
     return [
       {

plugins/steve/resource-instance.js

@@ -702,6 +702,10 @@ export default {
   // ------------------------------------------------------------------
 
   canDelete() {
+    return this._canDelete;
+  },
+
+  _canDelete() {
     return this.hasLink('remove') && this.$rootGetters['type-map/optionsFor'](this.type).isRemovable;
   },