Component

API Server / GraphQL

Infrahub version

1.9.3

Current Behavior

Administrators are allowed to delete CoreAccount nodes, the mutation doesn't take the account being deleted under consideration. As a result it's possible for an administrator to delete their own account.

Expected Behavior

Due to the risk of someone deleting the last admin account there should be a check that ensures that a request to delete your own account is rejected.

Steps to Reproduce

1. Start a new test instance of Infrahub
2. Run this script:

from infrahub_sdk import InfrahubClientSync


def main() -> None:
    client = InfrahubClientSync()

    account = client.get(kind="CoreAccount", name__value="admin")
    account.delete()
    print(f"Deleted CoreAccount 'admin' (id={account.id})")


if __name__ == "__main__":
    main()

3. Rerun the script again and notice the failure
4. No it's not possible to login to Infrahub any longer

Additional Information

Note that the protection around this should also consider the scenario of a user that is using the feature to override the context and make the change appear as if it's coming from another user. I.e. an admin should not be allowed to specify some other account as the context override account and by doing so be allowed to remove their own account.