{"record":{"id":"8518ee96ea6d07cf","repo":"theonedev/onedev","slug":"should-only-enable-normal-users","errorCode":null,"errorMessage":"Should only enable normal users","messagePattern":"Should only enable normal users","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java","lineNumber":456,"sourceCode":"\t\t\tthrow new BadRequestException(\"Should only disable normal users\");\n\t\tvar user = userService.load(userId);\n\t\tuserService.disable(user);\n\n\t\tauditService.audit(null, \"disabled account \\\"\" + user.getName() + \"\\\" via RESTful API\", null, null);\n\n\t\treturn Response.ok().build();\n    }\n\n\t@Api(order=1970, description=\"Enable user\")\n\t@Path(\"/{userId}/enable\")\n    @POST\n    public Response enableUser(@PathParam(\"userId\") Long userId) {\n\t\tif (!subscriptionService.isSubscriptionActive())\n\t\t\tthrow new NotAcceptableException(\"This operation requires active subscription\");\n\t\tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (userId <= User.ROOT_ID)\t\t\n\t\t\tthrow new BadRequestException(\"Should only enable normal users\");\n\t\tvar user = userService.load(userId);\n\t\tuserService.enable(user);\n\n\t\tauditService.audit(null, \"enabled account \\\"\" + user.getName() + \"\\\" via RESTful API\", null, null);\n\n\t\treturn Response.ok().build();\n    }\n\n\t@Api(order=1980, description=\"Convert to service account\")\n\t@Path(\"/{userId}/convert-to-service-account\")\n    @POST\n    public Response convertToServiceAccount(@PathParam(\"userId\") Long userId) {\n\t\tif (!subscriptionService.isSubscriptionActive())\n\t\t\tthrow new NotAcceptableException(\"This operation requires active subscription\");\n\t\tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (userId <= User.ROOT_ID)\t\t\n\t\t\tthrow new BadRequestException(\"Should only convert normal users to service accounts\");","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java#L438-L474","documentation":"OneDev's REST endpoint POST /users/{userId}/enable refuses to enable (un-disable) any account whose id is not a normal user id. User.ROOT_ID and other reserved/system accounts (ids <= ROOT_ID, e.g. root) cannot be enabled via this API. The guard exists because system accounts must not be lifecycle-managed through the REST API.","triggerScenarios":"Calling POST /rest/v1/users/{userId}/enable as an active-subscription administrator where userId <= User.ROOT_ID (e.g. the root account id or an id of 0/null resolved to a reserved account).","commonSituations":"Scripting bulk user management and iterating over a user list that includes the built-in root account; hardcoding id 1 or 0 assuming user ids start there; calling the endpoint on the wrong resource id.","solutions":["Verify the target user id is a normal (ordinary) user with id > User.ROOT_ID before calling the enable endpoint","Look up the intended user via GET /users and use its actual id, excluding the root/system accounts","Enable system/root-level accounts through the server UI or database administration instead of the REST API"],"exampleFix":"// before\ncurl -X POST .../users/1/enable   // id <= ROOT_ID -> 400\n// after\nconst users = await rest.get('/users');\nconst target = users.find(u => u.id > 1 && u.name === 'alice');\nawait rest.post(`/users/${target.id}/enable`);","handlingStrategy":"validation","validationCode":"if (typeof userId !== 'number' || userId <= 1) throw new Error('Only normal users (id > User.ROOT_ID) can be enabled');","typeGuard":"function isNormalUserId(id) { return typeof id === 'number' && Number.isInteger(id) && id > 1; }","tryCatchPattern":"try { await rest.post(`/users/${id}/enable`); } catch (e) { if (e.status === 400 && /normal users/.test(e.message)) { /* skip system account */ } else throw e; }","preventionTips":["Filter out root/system accounts when scripting user lifecycle operations","Look up real ids via GET /users instead of hardcoding small ids","Check the account type (ORDINARY) before lifecycle calls"],"tags":["rest-api","user-management","bad-request","onedev"],"backgroundTag":"invalid-argument-value","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}