diff options
Diffstat (limited to 'src/DevHive.Services/Services/UserService.cs')
| -rw-r--r-- | src/DevHive.Services/Services/UserService.cs | 23 |
1 files changed, 16 insertions, 7 deletions
diff --git a/src/DevHive.Services/Services/UserService.cs b/src/DevHive.Services/Services/UserService.cs index dd44358..c8624ee 100644 --- a/src/DevHive.Services/Services/UserService.cs +++ b/src/DevHive.Services/Services/UserService.cs @@ -249,16 +249,25 @@ namespace DevHive.Services.Services User user = this._userMapper.Map<User>(updateUserServiceModel); /* Fetch Roles and replace model's*/ - HashSet<Role> roles = new(); - int rolesCount = updateUserServiceModel.Roles.Count; - for (int i = 0; i < rolesCount; i++) + //Do NOT allow a user to change his roles, unless he is an Admin + bool isAdmin = (await this._userRepository.GetByIdAsync(updateUserServiceModel.Id)) + .Roles.Any(r => r.Name == Role.AdminRole); + + if (isAdmin) { - Role role = await this._roleRepository.GetByNameAsync(updateUserServiceModel.Roles.ElementAt(i).Name) ?? - throw new ArgumentException("Invalid role name!"); + HashSet<Role> roles = new(); + foreach (var role in updateUserServiceModel.Roles) + { + Role returnedRole = await this._roleRepository.GetByNameAsync(role.Name) ?? + throw new ArgumentException($"Role {role.Name} does not exist!"); - roles.Add(role); + roles.Add(returnedRole); + } + user.Roles = roles; } - user.Roles = roles; + //Preserve original user roles + else + user.Roles = (await this._userRepository.GetByIdAsync(updateUserServiceModel.Id)).Roles; /* Fetch Friends and replace model's*/ HashSet<UserFriends> friends = new(); |