{"record":{"id":"7036b486b6856704","repo":"fullstackhero/dotnet-starter-kit","slug":"users-cannot-deactivate-themselves","errorCode":null,"errorMessage":"Users cannot deactivate themselves.","messagePattern":"Users cannot deactivate themselves\\.","errorType":"exception","errorClass":"CustomException","httpStatus":400,"severity":"warning","filePath":"src/Modules/Identity/Modules.Identity/Services/UserStatusService.cs","lineNumber":87,"sourceCode":"            TargetUser: targetUser,\n            ActivateUser: activateUser,\n            TenantId: multiTenantContextAccessor?.MultiTenantContext?.TenantInfo?.Id);\n    }\n\n    private async Task ValidateTogglePermissionsAsync(\n        ToggleStatusContext context,\n        CancellationToken cancellationToken)\n    {\n        if (!await userManager.IsInRoleAsync(context.Actor, RoleConstants.Admin))\n        {\n            await AuditPolicyFailureAsync(context, \"ActorNotAdmin\", cancellationToken);\n            throw new ForbiddenException(\"Only administrators can change user status.\");\n        }\n\n        if (!context.ActivateUser && context.ActorId.ToString() == context.TargetUser.Id)\n        {\n            await AuditPolicyFailureAsync(context, \"SelfDeactivationBlocked\", cancellationToken);\n            throw new CustomException(\"Users cannot deactivate themselves.\", Array.Empty<string>(), HttpStatusCode.BadRequest);\n        }\n\n        if (!context.ActivateUser && await userManager.IsInRoleAsync(context.TargetUser, RoleConstants.Admin))\n        {\n            await AuditPolicyFailureAsync(context, \"AdminDeactivationBlocked\", cancellationToken);\n            throw new CustomException(\"Administrators cannot be deactivated.\", Array.Empty<string>(), HttpStatusCode.BadRequest);\n        }\n\n        if (!context.ActivateUser)\n        {\n            await EnsureMinimumActiveAdminsAsync(context, cancellationToken);\n        }\n    }\n\n    private async Task EnsureMinimumActiveAdminsAsync(\n        ToggleStatusContext context,\n        CancellationToken cancellationToken)\n    {","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/fullstackhero/dotnet-starter-kit/blob/3f2959e683e9f83f13e55e1678c9119f63c7e8e5/src/Modules/Identity/Modules.Identity/Services/UserStatusService.cs#L69-L105","documentation":"UserStatusService.ValidateTogglePermissionsAsync throws CustomException with 400 BadRequest (\"Users cannot deactivate themselves.\") when an admin attempts to toggle their own account to inactive. Self-deactivation is blocked because it would lock the actor out mid-session; the policy failure is audited first as SelfDeactivationBlocked.","triggerScenarios":"An administrator invoking toggle-status with their own userId and activateUser=false; scripting bulk deactivations that include the acting admin's id.","commonSituations":"Admins trying to 'test' deactivation on themselves; bulk scripts iterating all users including the operator; UIs not filtering out the current user from deactivation lists.","solutions":["Have another administrator perform the deactivation.","Exclude the current user's id from bulk deactivation lists.","If the account must be disabled, use a second admin account.","Update the UI to hide/disable the deactivate action for the logged-in user."],"exampleFix":"// before\nawait mediator.Send(new ToggleUserStatusCommand { UserId = currentUserId, ActivateUser = false });\n// after\nif (targetId != currentUserId)\n    await mediator.Send(new ToggleUserStatusCommand { UserId = targetId, ActivateUser = false });","handlingStrategy":"validation","validationCode":"if (command.UserId == currentUserId && !command.ActivateUser)\n    return Result.BadRequest(\"You cannot deactivate your own account.\");","typeGuard":null,"tryCatchPattern":"try { ... }\ncatch (CustomException) { showBanner(\"Self-deactivation is not allowed; ask another admin.\"); }","preventionTips":["Filter the current user out of deactivate-able lists in the UI.","Add a command-validator rule rejecting self-deactivation early.","Document the policy for admin workflows.","Skip the acting admin in bulk deactivation scripts."],"tags":["identity","policy","self-deactivation","bad-request"],"backgroundTag":"invalid-state-transition","analyzedSha":"3f2959e683e9f83f13e55e1678c9119f63c7e8e5","analyzedAt":"2026-09-15T22:20:53.684Z","contentChangedAt":"2026-09-15T22:20:53.684Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}