Repository navigation
[Core]: Admin users are not supposed to be deleted #22
Description
SMART Plan — Admin users cannot be deleted
Specific
Users assigned the super_admin role must not be deletable through the Filament admin panel. Any attempt to trigger the delete action on an admin user must be blocked silently (action disabled) or with a visible notification, and the record must remain in the database.
Measurable
- The delete table action is disabled/hidden for
super_adminusers inUsersTable - A non-admin user can still be deleted normally
- Verified by two automated tests (see AAA below)
Achievable
Add a canDelete() guard to the delete action in Modules/Core/Filament/Admin/Resources/Users/Tables/UsersTable.php:
DeleteAction::make()
->hidden(fn (User $record) => $record->hasRole(UserRole::SuperAdmin))or via the model policy:
// UserPolicy::delete()
return ! $user->hasRole(UserRole::SuperAdmin);Relevant
Accidental deletion of the only admin account would lock the entire application. This is a safety constraint, not an access-control concern.
Time-bound
Sprint 5.
Arrange · Act · Assert
// Modules/Core/Tests/Feature/UsersTest.php
#[Test]
public function it_prevents_deletion_of_admin_users(): void
{
// Arrange
$adminUser = User::factory()->create();
$adminUser->assignRole(UserRole::SuperAdmin);
$adminUser->companies()->attach($this->company);
// Act
livewire(ListUsers::class)
->callTableAction(DeleteAction::class, $adminUser)
// Assert — user is still in the database
->assertDatabaseHas('users', ['id' => $adminUser->id]);
}
#[Test]
public function it_allows_deletion_of_regular_users(): void
{
// Arrange
$regularUser = User::factory()->create();
$regularUser->assignRole(UserRole::UserAdmin);
$regularUser->companies()->attach($this->company);
// Act
livewire(ListUsers::class)
->callTableAction(DeleteAction::class, $regularUser)
// Assert — user is gone
->assertDatabaseMissing('users', ['id' => $regularUser->id]);
}
Activity
[-]Admin users are not supposed to be deleted[/-][+][Core]: Admin users are not supposed to be deleted[/+]feat(#22): prevent deletion of super_admin users