From f12abca3fce2ba4ffff47978d915fe86819bde6d Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Mon, 20 Jul 2026 17:33:15 -0500
Subject: [PATCH] Simplify user delete checks

---
 server/controllers/UserController.js | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/server/controllers/UserController.js b/server/controllers/UserController.js
index c0cbfc747..4a4da0366 100644
--- a/server/controllers/UserController.js
+++ b/server/controllers/UserController.js
@@ -365,18 +365,14 @@ class UserController {
   async delete(req, res) {
     const user = req.reqUser
 
-    if (user.isRoot && !req.user.isRoot) {
-      Logger.error(`[UserController] Admin user "${req.user.username}" attempted to delete root user`)
-      return res.sendStatus(403)
-    }
-    if (user.isRoot) {
-      Logger.error('[UserController] Attempt to delete root user. Root user cannot be deleted')
-      return res.sendStatus(400)
-    }
     if (req.user.id === req.params.id) {
       Logger.error(`[UserController] User ${req.user.username} is attempting to delete self`)
       return res.sendStatus(400)
     }
+    if (user.isRoot) {
+      Logger.error(`[UserController] Admin user "${req.user.username}" attempted to delete root user`)
+      return res.sendStatus(403)
+    }
 
     // Todo: check if user is logged in and cancel streams