diff --git a/ibt2.py b/ibt2.py
index e7259ec..aea533f 100755
--- a/ibt2.py
+++ b/ibt2.py
@@ -479,7 +479,14 @@ class UsersHandler(BaseHandler):
if id_ is None:
return self.build_error(status=404, message='unable to access the resource')
if not self.has_permission(id_):
- return
+ return self.build_error(status=401, message='insufficient permissions: must be admin')
+ if id_ == self.current_user:
+ return self.build_error(status=401, message='unable to delete the current user; ask an admin')
+ doc = self.db.getOne(self.collection, {'_id': id_})
+ if not doc:
+ return self.build_error(status=404, message='unable to access the resource')
+ if doc.get('username') == 'admin':
+ return self.build_error(status=401, message='unable to delete the admin user')
howMany = self.db.delete(self.collection, id_)
if id_ in self._users_cache:
del self._users_cache[id_]
diff --git a/monco.py b/monco.py
index 2ee8076..e8e7b58 100644
--- a/monco.py
+++ b/monco.py
@@ -296,8 +296,8 @@ class Monco(object):
:param force: force the deletion of all documents, when `_id_or_query` is empty
:type force: bool
- :returns: how many documents were removed
- :rtype: int
+ :returns: dictionary with the number or removed documents
+ :rtype: dict
"""
if not _id_or_query and not force:
return
diff --git a/src/Users.vue b/src/Users.vue
index 87b1979..ebab621 100644
--- a/src/Users.vue
+++ b/src/Users.vue
@@ -10,6 +10,7 @@
Username
Email
+ Delete
@@ -22,6 +23,11 @@
{{user.email}}
+
+
+ delete
+
+
@@ -71,11 +77,12 @@ export default {
},
deleteUser(userId) {
- this.usersUrl.update({id: userId}).then((response) => {
+ this.usersUrl.delete({id: userId}).then((response) => {
return response.json();
}, (response) => {
- this.$refs.dialogObj.show({text: 'unable to delete the user'});
+ this.$refs.dialogObj.show({text: 'unable to delete the user: ' + response.body.message});
}).then((data) => {
+ this.getUsers();
});
}
},