check project owner is not removed

CHANGELOG.md

@@ -10,6 +10,7 @@
 * increase size of input field in users page
 * add a readonly input field under email for showing the email domain*
 * Add "custom_users" key to config file, to be used with various scripts
+* Check that user being removed is not owner or last member of a project
 * Allow accents in user's first and last names
 
 

routes/users.js

@@ -538,6 +538,23 @@ router.delete('/user/:id', async function(req, res) {
             res.status(403).send({ message: 'User owns some web sites, please change owner first!' });
             return;
         }
+        let projects = await dbsrv.mongo_projects().find({ owner: uid }).toArray();
+        if (projects && projects.length > 0) {
+            res.status(403).send({ message: 'User owns some projects, please change owner first!' });
+            return;
+        }
+        const allprojects = user.projects ? user.projects : [];
+        let empty_projects = '';
+        for (let project_name of allprojects) {
+            const users_in_project = await dbsrv.mongo_users().find({ 'projects': project_name }).count();
+            if (users_in_project <= 1) {
+                empty_projects += ', ' + project_name;
+            }
+        }
+        if(empty_projects != '') {
+            res.status(403).send({ message: 'User is the last member of project(s)${empty_projects}' });
+            return;
+        }
         usrsrv.delete_user(user, session_user.uid, mail_message, mail_send).then(function() {
             res.send({ message: 'User deleted' });
             return;