From 1696c6c41428f98c06fcaf8838d43bcbf784c413 Mon Sep 17 00:00:00 2001 From: Johnny Date: Sat, 31 Jan 2026 23:08:09 +0800 Subject: [PATCH] fix: add nil check for currentUser in DeleteUser Defense-in-depth fix: Add missing nil check before accessing currentUser.ID and currentUser.Role in DeleteUser function. While the auth interceptor should block unauthenticated requests, this check prevents potential nil pointer panic if fetchCurrentUser returns (nil, nil). --- server/router/api/v1/user_service.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/router/api/v1/user_service.go b/server/router/api/v1/user_service.go index 64e0e42e9..794949cdd 100644 --- a/server/router/api/v1/user_service.go +++ b/server/router/api/v1/user_service.go @@ -301,6 +301,9 @@ func (s *APIV1Service) DeleteUser(ctx context.Context, request *v1pb.DeleteUserR if err != nil { return nil, status.Errorf(codes.Internal, "failed to get user: %v", err) } + if currentUser == nil { + return nil, status.Errorf(codes.Unauthenticated, "user not authenticated") + } if currentUser.ID != userID && currentUser.Role != store.RoleAdmin { return nil, status.Errorf(codes.PermissionDenied, "permission denied") }