Hide the Delete User button for users who don't have access to do it

[AshrafMd-1]

Describe the bug
Currently district admin and above have a delete user button shown in the view users in facilities, even though they don't have permission to delete it

To Reproduce
Steps to reproduce the behavior:

1. Go to Facility
2. Click on Manage facilities
3. Click on View users
4. See error

Expected behavior
Hide the delete user button for users, who don't have permission to do it

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[ayush-seth]

This is the function that controls the visibility of the delete button

 const showDelete = (user: any) => {
    const STATE_ADMIN_LEVEL = USER_TYPES.indexOf("StateAdmin");
    const STATE_READ_ONLY_ADMIN_LEVEL =
      USER_TYPES.indexOf("StateReadOnlyAdmin");
    const DISTRICT_ADMIN_LEVEL = USER_TYPES.indexOf("DistrictAdmin");
    const level = USER_TYPES.indexOf(user.user_type);
    const currentUserLevel = USER_TYPES.indexOf(authUser.user_type);
    if (user.is_superuser) return true;

    if (currentUserLevel >= STATE_ADMIN_LEVEL)
      return user.state_object?.id === authUser.state;
    if (
      currentUserLevel < STATE_READ_ONLY_ADMIN_LEVEL &&
      currentUserLevel >= DISTRICT_ADMIN_LEVEL &&
      currentUserLevel > level
    )
      return facilityData?.district_object_id === authUser.district;
    return false;
  };

Reproducing the issue, I can see that the delete button is visible because the 3rd if condition is evaluating to true which because currentUserLevel > level which implies that the authUser should be able to delete user and they also belong to the same district. Which makes me think something is wrong on the backend here? Since the logic for showing the button seems to be right. How can I find out why exactly the backend API is failing?

[rithviknishad]

@ayush-seth coronasafe/care@0cbff7c has changed the restriction to much simpler, only "StateAdmin" user can delete other users.

[rithviknishad]

This change was not reflected in front-end. Hence the issue.

[ayush-seth]

cool, I can take this up. Can you assign it to me? @rithviknishad