Deleting an admin gives a 500 error, and cannot disable the same user

Describe the bug When attempting to delete a user, BTCPay Server throws a 500 error and does not delete it.

When I attempt to disable that same user, the UI says that the user is disabled via the toast message but the user is not disabled and the logs complain as well.

I also tried disabling/deleting after removing admin privs from the user, also without success.

To Reproduce the bug Steps to reproduce the reported bug:

1. Create a new user and make them admin
2. Login as the user
3. Logout
4. Login as another admin
5. Attempt to delete or disable the user

Expected behavior

Would expect disabling/deleting to disable or delete.

Screenshots

500 when attempting to delete:

Disabling failing but saying it succeeded:

Your BTCPay Environment (please complete the following information):

• BTCPay Server Version: v1.5.3.0
• Deployment Method: Docker
• Browser: Brave

Logs

fail: Microsoft.AspNetCore.Server.Kestrel: Connection id "0HMHV6EOA4NEV", Request id "0HMHV6EOA4NEV:0000013C": An unhandled exception was thrown by the application.
System.InvalidOperationException: The instance of entity type 'ApplicationUser' cannot be tracked because another instance with the same key value for {'Id'} is already being tracked. When attaching existing entities, ensure that only one entity instance with a given key value is attached. Consider using 'DbContextOptionsBuilder.EnableSensitiveDataLogging' to see the conflicting key values.
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.IdentityMap`1.ThrowIdentityConflict(InternalEntityEntry entry)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.IdentityMap`1.Add(TKey key, InternalEntityEntry entry, Boolean updateDuplicate)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.IdentityMap`1.Add(TKey key, InternalEntityEntry entry)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.NullableKeyIdentityMap`1.Add(InternalEntityEntry entry)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.StartTracking(InternalEntityEntry entry)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.InternalEntityEntry.SetEntityState(EntityState oldState, EntityState newState, Boolean acceptChanges, Boolean modifyProperties)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.EntityGraphAttacher.PaintAction(EntityEntryGraphNode`1 node)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.EntityEntryGraphIterator.TraverseGraph[TState](EntityEntryGraphNode`1 node, Func`2 handleNode)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.EntityGraphAttacher.AttachGraph(InternalEntityEntry rootEntry, EntityState targetState, EntityState storeGeneratedWithKeySetTargetState, Boolean forceStateWhenUnknownKey)
   at Microsoft.EntityFrameworkCore.DbContext.SetEntityState(InternalEntityEntry entry, EntityState entityState)
   at Microsoft.EntityFrameworkCore.DbContext.Remove[TEntity](TEntity entity)
   at Microsoft.AspNetCore.Identity.EntityFrameworkCore.UserStore`9.DeleteAsync(TUser user, CancellationToken cancellationToken)
   at BTCPayServer.Services.UserService.DeleteUserAndAssociatedData(ApplicationUser user) in /source/BTCPayServer/Services/UserService.cs:line 112
   at BTCPayServer.Controllers.UIServerController.DeleteUserPost(String userId) in /source/BTCPayServer/Controllers/UIServerController.Users.cs:line 241
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextExceptionFilterAsync>g__Awaited|26_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ExceptionContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authorization.Policy.AuthorizationMiddlewareResultHandler.HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at BTCPayServer.Hosting.BTCPayMiddleware.Invoke(HttpContext httpContext) in /source/BTCPayServer/Hosting/BTCpayMiddleware.cs:line 101
   at BTCPayServer.Hosting.GreenfieldMiddleware.Invoke(HttpContext httpContext) in /source/BTCPayServer/Hosting/GreenfieldMiddleware.cs:line 50
   at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
   at BTCPayServer.Hosting.HeadersOverrideMiddleware.Invoke(HttpContext httpContext) in /source/BTCPayServer/Hosting/HeadersOverrideMiddleware.cs:line 30
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
fail: BTCPayServer.Services.UserService: Failed to set lockout for user 01fbb17d-7f78-4be1-bf1e-add0fbdea997
fail: BTCPayServer.Services.UserService: Failed to set lockout for user 01fbb17d-7f78-4be1-bf1e-add0fbdea997

[rustywave]

Just created my first pull request (for any open source project)…please let me know if I’ve done anything wrong and apologies if so!

I was able to reproduce this issue in Chrome. There are two issues addressed, “Remove” and “Enable”.

1. “Remove” issue likely due to multiple context instances. Occurs when this line is called before removal attempt: await _userManager.GetUsersInRoleAsync(Roles.ServerAdmin); Not easy to deal with UserManager ChangeTracker so went with solution as described here: https://stackoverflow.com/questions/60150988/aspnetusermanager-tracking-error-when-adding-and-deleting-users

2. “Enable” issue due to conditional check. Added additional check for user id

Note: Discovered existing bug with modifying users when first disabling, then marking as admin, which remains an issue. Steps to reproduce:

• Add new user or use existing
• Disable
• Edit > Toggle IsAdmin, Save
• Attempting to Remove or Enable will now return Successful but actually does not work

[pavlenex]

Thanks for reporting this. I was able to reproduce this on 1.5.4, so this is a bug for sure. To replicate:

• Add new user
• Make them admin
• Delete the user
• Blank page (500) with same logs as @sethforprivacy posted