diff --git a/packages/worker/src/api/controllers/global/users.ts b/packages/worker/src/api/controllers/global/users.ts index df1797132e..9d7349851b 100644 --- a/packages/worker/src/api/controllers/global/users.ts +++ b/packages/worker/src/api/controllers/global/users.ts @@ -23,11 +23,10 @@ const MAX_USERS_UPLOAD_LIMIT = 1000 export const save = async (ctx: any) => { try { - if ( - !ctx.request.body._id && - !ctx.internal && - (!ctx.user || !ctx.user.admin || !ctx.user.admin.global) - ) { + const body = ctx.request.body + const isCreate = !body._id + const isAdmin = !!ctx.user.admin?.global + if (isCreate && !isAdmin) { ctx.throw(403, "Only admin user can create new user.") } ctx.body = await sdk.users.save(ctx.request.body)