Make sure we deny deprecating default strategy

lib/routes/admin-api/strategy.js

@@ -85,6 +85,9 @@ class StrategyController extends Controller {
     async deprecateStrategy(req, res) {
         const userName = extractUser(req);
         const { strategyName } = req.params;
+        if (strategyName === 'default') {
+            res.status(403).end();
+        } else {
             try {
                 await this.strategyService.deprecateStrategy(
                     strategyName,
@@ -95,6 +98,7 @@ class StrategyController extends Controller {
                 handleErrors(res, this.logger, error);
             }
         }
+    }
 
     async reactivateStrategy(req, res) {
         const userName = extractUser(req);

lib/routes/admin-api/strategy.test.js

@@ -248,3 +248,11 @@ test('reactivating a non-existent strategy yields 404', t => {
         .post(`${base}/api/admin/strategies/non-existent-strategy/reactivate`)
         .expect(404);
 });
+test(`deprecating 'default' strategy will yield 403`, t => {
+    t.plan(0);
+    const { request, base, perms } = getSetup();
+    perms.withPermissions(UPDATE_STRATEGY);
+    return request
+        .post(`${base}/api/admin/strategies/default/deprecate`)
+        .expect(403);
+});

test/e2e/api/admin/strategy.e2e.test.js

@@ -166,3 +166,9 @@ test.serial('can reactivate a deprecated strategy', async t => {
         .expect(200)
         .expect(res => t.is(res.body.deprecated, false));
 });
+
+test.serial('cannot deprecate default strategy', async t => {
+    t.plan(0);
+    const request = await setupApp(stores);
+    await request.post('/api/admin/strategies/default/deprecate').expect(403);
+});