{"record":{"id":"e84d13a35b75203c","repo":"SigNoz/signoz","slug":"codeforbidden-e84d13","errorCode":"CodeForbidden","errorMessage":"cannot self delete","messagePattern":"cannot self delete","errorType":"error_code","errorClass":"errors.Error","httpStatus":403,"severity":"error","filePath":"pkg/modules/user/impluser/setter.go","lineNumber":225,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := user.ErrIfRoot(); err != nil {\n\t\treturn errors.WithAdditionalf(err, \"cannot delete root user\")\n\t}\n\n\tif err := user.ErrIfDeleted(); err != nil {\n\t\treturn errors.WithAdditionalf(err, \"cannot delete already deleted user\")\n\t}\n\n\tdeleter, err := module.store.GetUser(ctx, valuer.MustNewUUID(deletedBy))\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif deleter.ID == user.ID {\n\t\treturn errors.New(errors.TypeForbidden, errors.CodeForbidden, \"cannot self delete\")\n\t}\n\n\terr = user.UpdateStatus(types.UserStatusDeleted)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tuserRoles, err := module.getter.GetRolesByUserID(ctx, user.ID)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\troleNames := roleNamesFromUserRoles(userRoles)\n\n\t// since revoke is idempotant multiple calls to revoke won't cause issues in case of retries\n\terr = module.authz.Revoke(\n\t\tctx,\n\t\torgID,","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/modules/user/impluser/setter.go#L207-L243","documentation":"DeleteUser refuses to soft-delete a user when the deleter (deletedBy claim) is the same user being deleted. Self-deletion is blocked as TypeForbidden to prevent lockout/loss of the last admin.","triggerScenarios":"DELETE user endpoint where the acting user's ID equals the target user.ID (module.store.GetUser(deletedBy).ID == user.ID).","commonSituations":"Admin testing deletion on their own account; automation using a service token tied to the account being removed; UI not hiding the delete button for the logged-in user's row.","solutions":["Use a different admin/service account to perform the deletion","Verify deletedBy != target userID in tooling before calling DeleteUser","Hide/disable self-delete actions in the admin UI"],"exampleFix":"// before\ndeleteUser(myUserID, deletedBy=myUserID) // 403\n// after\notherAdmin.deleteUser(myUserID) // deletedBy=otherAdmin.ID","handlingStrategy":"validation","validationCode":"if deletedBy == targetUserID {\n    return errors.New(\"forbidden\", \"cannot self delete; use another admin\")\n}\ndeleteUser(ctx, targetUserID, deletedBy)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Disable delete action on the current user's row in admin UI","Use a dedicated service account for automated deletions"],"tags":["self-operation-guard","delete-guard","user-module"],"backgroundTag":"self-operation-forbidden","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}