{"record":{"id":"ce0b9ce721a32d95","repo":"fullstackhero/dotnet-starter-kit","slug":"administrators-cannot-be-deactivated","errorCode":null,"errorMessage":"Administrators cannot be deactivated.","messagePattern":"Administrators cannot be deactivated\\.","errorType":"exception","errorClass":"CustomException","httpStatus":400,"severity":"warning","filePath":"src/Modules/Identity/Modules.Identity/Services/UserStatusService.cs","lineNumber":93,"sourceCode":"        ToggleStatusContext context,\n        CancellationToken cancellationToken)\n    {\n        if (!await userManager.IsInRoleAsync(context.Actor, RoleConstants.Admin))\n        {\n            await AuditPolicyFailureAsync(context, \"ActorNotAdmin\", cancellationToken);\n            throw new ForbiddenException(\"Only administrators can change user status.\");\n        }\n\n        if (!context.ActivateUser && context.ActorId.ToString() == context.TargetUser.Id)\n        {\n            await AuditPolicyFailureAsync(context, \"SelfDeactivationBlocked\", cancellationToken);\n            throw new CustomException(\"Users cannot deactivate themselves.\", Array.Empty<string>(), HttpStatusCode.BadRequest);\n        }\n\n        if (!context.ActivateUser && await userManager.IsInRoleAsync(context.TargetUser, RoleConstants.Admin))\n        {\n            await AuditPolicyFailureAsync(context, \"AdminDeactivationBlocked\", cancellationToken);\n            throw new CustomException(\"Administrators cannot be deactivated.\", Array.Empty<string>(), HttpStatusCode.BadRequest);\n        }\n\n        if (!context.ActivateUser)\n        {\n            await EnsureMinimumActiveAdminsAsync(context, cancellationToken);\n        }\n    }\n\n    private async Task EnsureMinimumActiveAdminsAsync(\n        ToggleStatusContext context,\n        CancellationToken cancellationToken)\n    {\n        var activeAdmins = await userManager.GetUsersInRoleAsync(RoleConstants.Admin);\n        if (!activeAdmins.Any(u => u.IsActive))\n        {\n            await AuditPolicyFailureAsync(context, \"NoActiveAdmins\", cancellationToken);\n            throw new CustomException(\"Tenant must have at least one active administrator.\", Array.Empty<string>(), HttpStatusCode.BadRequest);\n        }","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/fullstackhero/dotnet-starter-kit/blob/3f2959e683e9f83f13e55e1678c9119f63c7e8e5/src/Modules/Identity/Modules.Identity/Services/UserStatusService.cs#L75-L111","documentation":"UserStatusService.ValidateTogglePermissionsAsync throws CustomException with 400 BadRequest (\"Administrators cannot be deactivated.\") when the target user holds the Admin role and deactivation was requested. The failure is audited as AdminDeactivationBlocked before throwing.","triggerScenarios":"Toggling activateUser=false for any user currently in the Admin role, regardless of whether the actor is also an admin.","commonSituations":"Bulk user-management scripts deactivating all inactive users including admins; operators deactivating a colleague who is an admin; seeded admin accounts included in cleanup jobs.","solutions":["Remove the Admin role from the target first, then deactivate.","Skip admin-role users in bulk deactivation jobs.","Deactivate a different, non-admin account instead.","If an admin must lose access, revoke their roles/logins rather than deactivating."],"exampleFix":"// before\nawait mediator.Send(new ToggleUserStatusCommand { UserId = adminUserId, ActivateUser = false });\n// after\nif (!await userManager.IsInRoleAsync(targetUser, RoleConstants.Admin))\n    await mediator.Send(new ToggleUserStatusCommand { UserId = adminUserId, ActivateUser = false });","handlingStrategy":"validation","validationCode":"var targetIsAdmin = await userManager.IsInRoleAsync(targetUser, RoleConstants.Admin);\nif (targetIsAdmin && !command.ActivateUser)\n    return Result.BadRequest(\"Admin accounts cannot be deactivated.\");","typeGuard":null,"tryCatchPattern":"try { ... }\ncatch (CustomException) { showBanner(\"Target is an administrator and cannot be deactivated.\"); }","preventionTips":["Load target roles before listing users for deactivation.","Exclude admin-role users from deactivation UI/actions.","Document that role removal is the path to retiring admin access.","Pre-check targets in bulk scripts."],"tags":["identity","policy","admin-protection","bad-request"],"backgroundTag":"invalid-state-transition","analyzedSha":"3f2959e683e9f83f13e55e1678c9119f63c7e8e5","analyzedAt":"2026-09-15T22:20:53.684Z","contentChangedAt":"2026-09-15T22:20:53.684Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}