{"record":{"id":"665568af62e30921","repo":"bitwarden/server","slug":"you-cannot-remove-yourself","errorCode":null,"errorMessage":"You cannot remove yourself.","messagePattern":"You cannot remove yourself\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs","lineNumber":405,"sourceCode":"        {\n            throw new BadRequestException(\"Provider must have at least one confirmed ProviderAdmin.\");\n        }\n\n        var result = new List<Tuple<ProviderUser, string>>();\n        var deletedUserIds = new List<Guid>();\n        var events = new List<(ProviderUser, EventType, DateTime?)>();\n\n        foreach (var providerUser in providerUsers)\n        {\n            try\n            {\n                if (providerUser.ProviderId != providerId)\n                {\n                    throw new BadRequestException(\"Invalid user.\");\n                }\n                if (providerUser.UserId == deletingUserId)\n                {\n                    throw new BadRequestException(\"You cannot remove yourself.\");\n                }\n\n                events.Add((providerUser, EventType.ProviderUser_Removed, null));\n\n                var user = keyedUsers.GetValueOrDefault(providerUser.UserId.GetValueOrDefault());\n                var email = user == null ? providerUser.Email : user.Email;\n                if (!string.IsNullOrWhiteSpace(email))\n                {\n                    await _mailService.SendProviderUserRemoved(provider.DisplayName(), email);\n                }\n\n                result.Add(Tuple.Create(providerUser, \"\"));\n                deletedUserIds.Add(providerUser.Id);\n            }\n            catch (BadRequestException e)\n            {\n                result.Add(Tuple.Create(providerUser, e.Message));\n            }","sourceCodeStart":387,"sourceCodeEnd":423,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs#L387-L423","documentation":"Thrown by ProviderService.RemoveUsers when the ProviderUser being removed has the same UserId as deletingUserId (the actor performing the removal). This prevents a provider admin from deleting their own membership, which would lock them out. It is a BadRequestException (HTTP 400) and, like the other per-user checks, is caught inside the foreach and returned as an error string for that specific user rather than failing the whole request.","triggerScenarios":"A provider admin includes their own providerUserId (where UserId == the authenticated deletingUserId) in the batch removal payload. Happens with 'select all' UI actions or when an admin pastes a full user list including themselves.","commonSituations":"Bulk-remove dialog with 'select all on page'; an automated cleanup script that lists every member; an admin who forgets they are in the list.","solutions":["Exclude the current user's own providerUserId from the removal payload before submitting.","In the UI, disable/prevent self-selection in the removal grid when the row's UserId matches the logged-in user.","Treat the returned per-user error string for the self row as expected and inform the user they were skipped."],"exampleFix":"// before\nawait providerService.RemoveUsers(providerId, selectedUserIds);\n\n// after\nvar safeUserIds = selectedUserIds\n    .Where(id => id != currentProviderUserId)\n    .ToList();\nawait providerService.RemoveUsers(providerId, safeUserIds);","handlingStrategy":"validation","validationCode":"var safeUserIds = selectedUserIds.Where(id => id != currentProviderUserId).ToList();","typeGuard":"static bool IsSelf(Guid providerUserId, Guid currentUserId, Dictionary<Guid,ProviderUser> map) =>\n    map.TryGetValue(providerUserId, out var pu) && pu.UserId == currentUserId;","tryCatchPattern":null,"preventionTips":["Disable self-selection in the removal UI.","Strip the current user's own ID from any 'select all' batch."],"tags":["provider","self-operation-guard","batch-operation","bad-request"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}