service actor undeletable: domain const, 403, hide delete UI

crates/bootstrap/tests/account_deletion_test.rs

@@ -311,3 +311,41 @@ async fn delete_forms_render_only_where_they_apply() {
     .await;
     assert!(!body.contains("/delete"), "embed page");
 }
+
+const SERVICE_ACTOR: &str = "00000000-0000-4000-8000-000000000000";
+
+#[tokio::test]
+async fn the_service_actor_is_not_deletable_and_offers_no_delete_ui() {
+    let (router, pool, alice, bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    promote(&pool, &bob.user_id).await;
+
+    let page = format!("/users/{SERVICE_ACTOR}");
+    let (status, _, body) = send(&router, get(&page, Some(&alice.cookie))).await;
+    assert_eq!(status, 200, "{body}");
+    assert!(
+        !body.contains(&format!("action=\"/users/{SERVICE_ACTOR}/delete\"")),
+        "admin sees a delete form for the service actor"
+    );
+
+    let uri = format!("/api/v1/users/{SERVICE_ACTOR}");
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 403, "{body}");
+
+    let req = Request::builder()
+        .uri(&uri)
+        .header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
+        .body(Body::empty())
+        .unwrap();
+    let (status, _, body) = send(&router, req).await;
+    assert_eq!(status, 200, "{body}");
+    assert!(body.contains("\"is_service_account\":true"), "{body}");
+
+    let req = Request::builder()
+        .uri(format!("/api/v1/users/{}", bob.user_id))
+        .header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
+        .body(Body::empty())
+        .unwrap();
+    let (_, _, body) = send(&router, req).await;
+    assert!(!body.contains("is_service_account"), "{body}");
+}