diff --git a/api/user_views.py b/api/user_views.py index 6be00ca..08572ee 100644 --- a/api/user_views.py +++ b/api/user_views.py @@ -60,10 +60,14 @@ def edit_user(user_id): @user_bp.route('/users/', methods=['DELETE']) @jwt_required() def remove_user(user_id): + logged_user_id = int(get_jwt_identity()) + logged_user_role = User.query.get(logged_user_id).role + if logged_user_role != "Administrator" and logged_user_id != user_id: + return jsonify({'error': f'You can not remove other user accounts.'}), 403 user_to_delete = User.query.get_or_404(user_id) db.session.delete(user_to_delete) db.session.commit() - return jsonify({}) + return jsonify({"msg": "User removed successfully."}) @user_bp.route('/login', methods=['POST']) def user_login():