preserve HTTPException raised by the primary-admin guard in /{user_id} DELETE
avoid converting intentional 403 responses into 500 errors
add a regression assertion in test_users.py for primary-admin deletion attempts
Why
The delete endpoint intentionally blocks deleting the first admin, but the broad exception handler catches that HTTPException and rethrows a 500. This patch keeps the intended 403 status code.
Testing
not run in this environment: existing backend test package references missing test.util.abstract_integration_test module
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/22296
**Author:** [@haosenwang1018](https://github.com/haosenwang1018)
**Created:** 3/6/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/users-delete-primary-admin-http-status`
---
### 📝 Commits (1)
- [`4b7313b`](https://github.com/open-webui/open-webui/commit/4b7313b036dc06d7788488628a81b9938fc72a66) fix(users): preserve 403 when primary admin deletion is blocked
### 📊 Changes
**2 files changed** (+7 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/users.py` (+2 -0)
📝 `backend/open_webui/test/apps/webui/routers/test_users.py` (+5 -0)
</details>
### 📄 Description
## Summary
- preserve HTTPException raised by the primary-admin guard in `/{user_id}` DELETE
- avoid converting intentional 403 responses into 500 errors
- add a regression assertion in `test_users.py` for primary-admin deletion attempts
## Why
The delete endpoint intentionally blocks deleting the first admin, but the broad exception handler catches that HTTPException and rethrows a 500. This patch keeps the intended 403 status code.
## Testing
- not run in this environment: existing backend test package references missing `test.util.abstract_integration_test` module
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/22296
Author: @haosenwang1018
Created: 3/6/2026
Status: ❌ Closed
Base:
main← Head:fix/users-delete-primary-admin-http-status📝 Commits (1)
4b7313bfix(users): preserve 403 when primary admin deletion is blocked📊 Changes
2 files changed (+7 additions, -0 deletions)
View changed files
📝
backend/open_webui/routers/users.py(+2 -0)📝
backend/open_webui/test/apps/webui/routers/test_users.py(+5 -0)📄 Description
Summary
/{user_id}DELETEtest_users.pyfor primary-admin deletion attemptsWhy
The delete endpoint intentionally blocks deleting the first admin, but the broad exception handler catches that HTTPException and rethrows a 500. This patch keeps the intended 403 status code.
Testing
test.util.abstract_integration_testmodule🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.