// require admin role
if (!securityService.hasRole(Roles.ADMIN_ROLE)) {
return error(ErrorMessages.APPLICATION_ACCESS_DENIED, Response.status(Response.Status.UNAUTHORIZED));
}
User currentUser = securityService.getCurrentUser();
try {
Role adminRole = securityService.findRole(Roles.ADMIN_ROLE);
if (currentUser.getId().equals(userId) && adminRole.getId().equals(roleId)) {
// you can't remove the admin role from yourself!
return error("You can not remove the administrator role from your own user.", Response.status(Response.Status.BAD_REQUEST));
}
User user = userService.getUserById(userId, currentUser.getAccount());
userService.removeRole(user, roleId);
} catch (UserNotFoundException e) {
return error("User not found.", Response.status(Response.Status.NOT_FOUND));
}