Merge pull request #345 from cisagov/320-error-message-when-attemptin…

…g-to-deny Allows regional admin to delete user via User Registration UI.
cisagov · Jun 26, 2024 · 14b9561 · 14b9561
2 parents 19775a8 + a59d25c
commit 14b9561
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/backend/src/api/users.ts b/backend/src/api/users.ts
@@ -176,7 +176,9 @@ class UpdateUser {
  *    - Users
  */
 export const del = wrapHandler(async (event) => {
-  if (!isGlobalWriteAdmin(event)) return Unauthorized;
+  if (!isGlobalWriteAdmin(event) && !isRegionalAdmin(event))
+    return Unauthorized;
+
   await connectToDatabase();
   const id = event.pathParameters?.userId;
   if (!id || !isUUID(id)) {