fix: prevent deletion of roles that are currently in use #194

src/modules/users/mod.rs

@@ -20,8 +20,8 @@ use crate::{
     decrypt, encrypt, generate_token, id,
     modules::{
         database::{
-            async_find_impl, batch_delete_impl, delete_impl, list_all_impl, manager::DB_MANAGER,
+            async_find_impl, async_secondary_find_impl, batch_delete_impl, delete_impl,
-            async_secondary_find_impl, update_impl, with_transaction,
+            list_all_impl, manager::DB_MANAGER, update_impl, with_transaction,
         },
         error::{code::ErrorCode, BichonResult},
         token::{AccessTokenModel, AccessTokenModelKey, TokenType},
@@ -132,6 +132,17 @@ pub struct BichonUserV2 {
 }
 
 impl BichonUserV2 {
+    pub fn is_using_role(&self, role_id: u64) -> bool {
+        if self.global_roles.contains(&role_id) {
+            return true;
+        }
+
+        if self.account_access_map.values().any(|&id| id == role_id) {
+            return true;
+        }
+        false
+    }
+
     pub async fn list_all() -> BichonResult<Vec<UserModel>> {
         Ok(list_all_impl::<UserModel>(DB_MANAGER.meta_db()).await?)
     }

src/modules/users/role.rs

@@ -37,6 +37,7 @@ use crate::{
         users::{
             payload::{RoleCreateRequest, RoleUpdateRequest},
             permissions::*,
+            UserModel,
         },
     },
     raise_error, utc_now,
@@ -344,6 +345,25 @@ impl UserRole {
                 ErrorCode::InvalidParameter
             ));
         }
+
+        let all_users = UserModel::list_all().await?;
+        let active_users: Vec<String> = all_users
+            .iter()
+            .filter(|user| user.is_using_role(id))
+            .map(|user| user.username.clone())
+            .collect();
+
+        if !active_users.is_empty() {
+            let user_list = active_users.join(", ");
+            return Err(raise_error!(
+                format!(
+                    "Cannot delete role (ID: {}): It is still assigned to the following users: {}",
+                    id, user_list
+                ),
+                ErrorCode::PermissionDenied
+            ));
+        }
+
         delete_impl(DB_MANAGER.meta_db(), move |rw| {
             rw.get()
                 .primary::<UserRole>(id)