do not allow removing the admin group

src/groups.js

@@ -53,6 +53,7 @@ GroupError.ALREADY_EXISTS = 'Already Exists';
 GroupError.NOT_FOUND = 'Not Found';
 GroupError.BAD_NAME = 'Bad name';
 GroupError.NOT_EMPTY = 'Not Empty';
+GroupError.NOT_ALLOWED = 'Not Allowed';
 
 function validateGroupname(name) {
     assert.strictEqual(typeof name, 'string');
@@ -87,9 +88,11 @@ function remove(id, callback) {
     assert.strictEqual(typeof id, 'string');
     assert.strictEqual(typeof callback, 'function');
 
+    // never allow admin group to be deleted
+    if (id === exports.ADMIN_GROUP_ID) return callback(new GroupError(GroupError.NOT_ALLOWED));
+
     groupdb.del(id, function (error) {
         if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error && error.reason === DatabaseError.IN_USE) return callback(new GroupError(GroupError.NOT_EMPTY));
         if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
 
         callback(null);

src/routes/groups.js

@@ -59,7 +59,7 @@ function remove(req, res, next) {
 
     groups.remove(req.params.groupId, function (error) {
         if (error && error.reason === GroupError.NOT_FOUND) return next(new HttpError(404, 'Group not found'));
-        if (error && error.reason === GroupError.NOT_EMPTY) return next(new HttpError(409, 'Group not empty'));
+        if (error && error.reason === GroupError.NOT_ALLOWED) return next(new HttpError(409, 'Group deletion not allowed'));
         if (error) return next(new HttpError(500, error));
 
         next(new HttpSuccess(204));

src/test/groups-test.js

@@ -58,7 +58,7 @@ describe('Groups', function () {
     });
 
     it('cannot create group - too big', function (done) {
-        groups.create(Array(256).join('a'), function (error) {
+        groups.create(new Array(256).join('a'), function (error) {
             expect(error.reason).to.be(GroupError.BAD_NAME);
             done();
         });
@@ -275,3 +275,21 @@ describe('Set user groups', function () {
         });
     });
 });
+
+describe('Admin group', function () {
+    before(function (done) {
+        async.series([
+            setup,
+            userdb.add.bind(null, USER_0.id, USER_0)
+        ], done);
+    });
+    after(cleanup);
+
+    it('cannot delete admin group ever', function (done) {
+        groups.remove(groups.ADMIN_GROUP_ID, function (error) {
+            expect(error.reason).to.equal(GroupError.NOT_ALLOWED);
+
+            done();
+        });
+    });
+});