{"record":{"id":"0ab3e4cc11701a59","repo":"monicahq/monica","slug":"you-can-t-delete-yourself","errorCode":null,"errorMessage":"You can't delete yourself.","messagePattern":"You can't delete yourself\\.","errorType":"validation","errorClass":"ValidationException","httpStatus":422,"severity":"error","filePath":"app/Domains/Settings/ManageUsers/Services/DestroyUser.php","lineNumber":64,"sourceCode":"    {\n        $this->data = $data;\n\n        $this->validate();\n        $this->destroyAllVaults();\n        $this->destroy();\n    }\n\n    private function validate(): void\n    {\n        $this->validateRules($this->data);\n\n        /** @var User */\n        $user = $this->account()->users()\n            ->findOrFail($this->data['user_id']);\n        $this->user = $user;\n\n        if ($this->data['user_id'] === $this->data['author_id']) {\n            throw new ValidationException(\n                'You can\\'t delete yourself.',\n            );\n        }\n    }\n\n    /**\n     * We will destroy all the vaults the user is the manager of, IF there are\n     * no other managers of the vault.\n     */\n    private function destroyAllVaults(): void\n    {\n        $vaultsUserIsManagerOf = $this->user->vaults()\n            ->wherePivot('permission', Vault::PERMISSION_MANAGE)\n            ->get();\n\n        foreach ($vaultsUserIsManagerOf as $vault) {\n            try {\n                $vault->users()","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/monicahq/monica/blob/e08e91734170b6bbd582cb578532c3948196124e/app/Domains/Settings/ManageUsers/Services/DestroyUser.php#L46-L82","documentation":"DestroyUser removes a user from the account (destroying vaults they solely manage). validate() rejects the case where user_id equals author_id — the authenticated account administrator trying to delete their own user — with a ValidationException that Laravel renders as a 422.","triggerScenarios":"Issuing the delete-user request with target user_id identical to the authenticated author's id: a UI passing the current user's id, or a cleanup script iterating users including the acting one.","commonSituations":"Frontend defaulting the selected user to the current admin, bulk scripts not excluding the acting author, or id mix-ups between the author_id and user_id fields.","solutions":["Target another user's id; to remove yourself, have another administrator perform the deletion","Exclude the current user from the deletable list in the UI","Compare user_id against the authenticated user before submitting"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate before calling: never send the acting author's own id\nif ($data['user_id'] === $data['author_id']) {\n    throw ValidationException::withMessages([\n        'user_id' => \"You can't delete yourself.\",\n    ]);\n}","typeGuard":"function isSelfDeletionAttempt(array $data): bool\n{\n    return $data['user_id'] === $data['author_id'];\n}","tryCatchPattern":"use Illuminate\\Validation\\ValidationException;\n\ntry {\n    app(DestroyUser::class)->execute($data);\n} catch (ValidationException $e) {\n    // already a 422: message 'You can\\'t delete yourself.' — keep and re-display to the user\n    throw $e;\n}","preventionTips":["Exclude the current user from the deletable-user list in the UI","Pass author_id from the server-side authenticated user, never from client input","Guard id equality at the call site so the request never leaves the browser","To remove your own access, have another administrator delete you"],"tags":["monica","users","self-guard","validation"],"backgroundTag":"self-operation-forbidden","analyzedSha":"e08e91734170b6bbd582cb578532c3948196124e","analyzedAt":"2026-08-17T01:36:49.014Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}