diff --git a/apps/users/api/user.py b/apps/users/api/user.py index 1088da6e8..57a896eae 100644 --- a/apps/users/api/user.py +++ b/apps/users/api/user.py @@ -4,6 +4,7 @@ from collections import defaultdict from django.utils.translation import gettext as _ from rest_framework import generics from rest_framework.decorators import action +from rest_framework.exceptions import PermissionDenied from rest_framework.response import Response from rest_framework_bulk import BulkModelViewSet @@ -57,6 +58,11 @@ class UserViewSet(CommonApiMixin, UserQuerysetMixin, SuggestionMixin, BulkModelV raise UnableToDeleteAllUsers() return True + def perform_destroy(self, instance): + if instance.username == 'admin': + raise PermissionDenied(_("Cannot delete the admin user. Please disable it instead.")) + super().perform_destroy(instance) + @action(methods=['get'], detail=False, url_path='suggestions') def match(self, request, *args, **kwargs): with tmp_to_root_org():