{"record":{"id":"b10a85397f59bc67","repo":"theonedev/onedev","slug":"should-only-disable-normal-users","errorCode":null,"errorMessage":"Should only disable normal users","messagePattern":"Should only disable normal users","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java","lineNumber":438,"sourceCode":"\t\tif (!getAuthUser().equals(user)) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(data).toXML();\n\t\t\tauditService.audit(null, \"changed account \\\"\" + user.getName() + \"\\\" via RESTful API\", oldAuditContent, newAuditContent);\n\t\t}\n\t\t\n\t\treturn Response.ok().build();\n    }\n\n\t@Api(order=1960, description=\"Disable user\")\n\t@Path(\"/{userId}/disable\")\n    @POST\n    public Response disableUser(@PathParam(\"userId\") Long userId) {\n\t\tif (!subscriptionService.isSubscriptionActive())\n\t\t\tthrow new NotAcceptableException(\"This operation requires active subscription\");\n\t\tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\t\t\n\t\tif (userId <= User.ROOT_ID)\t\t\n\t\t\tthrow new BadRequestException(\"Should only disable normal users\");\n\t\tvar user = userService.load(userId);\n\t\tuserService.disable(user);\n\n\t\tauditService.audit(null, \"disabled account \\\"\" + user.getName() + \"\\\" via RESTful API\", null, null);\n\n\t\treturn Response.ok().build();\n    }\n\n\t@Api(order=1970, description=\"Enable user\")\n\t@Path(\"/{userId}/enable\")\n    @POST\n    public Response enableUser(@PathParam(\"userId\") Long userId) {\n\t\tif (!subscriptionService.isSubscriptionActive())\n\t\t\tthrow new NotAcceptableException(\"This operation requires active subscription\");\n\t\tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (userId <= User.ROOT_ID)\t\t\n\t\t\tthrow new BadRequestException(\"Should only enable normal users\");","sourceCodeStart":420,"sourceCodeEnd":456,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java#L420-L456","documentation":"Thrown by UserResource.disableUser when the target userId is not a normal user. OneDev reserves ids <= User.ROOT_ID (system/root accounts, e.g. id 1 and built-in users); these cannot be disabled, so the endpoint rejects them with 400 Bad Request.","triggerScenarios":"POST /rest/users/{userId}/disable with userId <= User.ROOT_ID — e.g. disabling user id 1 (root) or another reserved/system account.","commonSituations":"Looping over all user ids starting from 1; blindly disabling accounts returned by broad queries that include system users.","solutions":["Only call disable for normal users — filter userId > User.ROOT_ID (e.g. > 1).","Check the user's type before disabling (skip built-in/system accounts).","Fix automation loops to start from real user ids.","Disable the offending account via admin UI if it truly is a normal user with a low id."],"exampleFix":"// before\nfor (long id = 1; id <= maxId; id++) disableUser(id); // hits id=1 -> 400\n// after\nfor (long id = User.ROOT_ID + 1; id <= maxId; id++)\n    if (isNormalUser(id)) disableUser(id);","handlingStrategy":"validation","validationCode":"if (userId <= 1 /* User.ROOT_ID */)\n    throw new IllegalArgumentException(\"Cannot disable system/root user id \" + userId);","typeGuard":"boolean isNormalUser(long userId) { return userId > User.ROOT_ID; }","tryCatchPattern":"try { client.disableUser(userId); }\ncatch (BadRequestException e) { log.error(\"Refusing to disable reserved user id \" + userId); }","preventionTips":["Filter out ids <= User.ROOT_ID in user-management loops.","Check user type (skip built-in/system accounts) before disabling.","Never iterate user ids from 1."],"tags":["rest","bad-request","system-user","user-disable"],"backgroundTag":"invalid-argument-value","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}