@PUT
@Path("{userId}/disable")
@Consumes(MediaType.APPLICATION_JSON)
public Response disableUser(@PathParam("userId") ObjectId userId) {
User currentUser = securityService.getCurrentUser();
// require admin role
if (!securityService.hasRole(Roles.ADMIN_ROLE)) {
return error(ErrorMessages.APPLICATION_ACCESS_DENIED, Response.status(Response.Status.UNAUTHORIZED));
}
try {
User user = userService.getUserById(userId, currentUser.getAccount());
user.setUserStatus(User.UserStatus.DISABLED);
user.setUserLocked(true);
// can't disable yourself
if (user.getId().equals(currentUser.getId())) {
return error("You can't disable yourself", Response.status(Response.Status.BAD_REQUEST));
}
// TODO: need to lock this user somehow... this will do for now
if (user.getUsername().equals(Constants.NODEABLE_SUPER_USERNAME)) {
return error("Can't delete super user", Response.status(Response.Status.BAD_REQUEST));
}
userService.updateUser(user);
} catch (UserNotFoundException e) {