include full domain tree to find instances having delete protection

Author: sudo87

server/src/main/java/com/cloud/user/DomainManagerImpl.java

@@ -624,20 +624,20 @@ protected boolean cleanupDomain(Long domainId, Long ownerId) throws ConcurrentOp
         DomainVO domainHandle = _domainDao.findById(domainId);
         logger.debug("Cleaning up domain {}", domainHandle);
         {
-            domainHandle.setState(Domain.State.Inactive);
-            _domainDao.update(domainId, domainHandle);
-
             SearchCriteria<DomainVO> sc = _domainDao.createSearchCriteria();
             sc.addAnd("parent", SearchCriteria.Op.EQ, domainId);
             List<DomainVO> domains = _domainDao.search(sc, null);
 
-            List<Long> domainIds = domains.stream().map(Domain::getId).collect(Collectors.toList());
-            validateNoDeleteProtectedVmsForDomainIds(domainHandle, domainIds);
-
             SearchCriteria<DomainVO> sc1 = _domainDao.createSearchCriteria();
             sc1.addAnd("path", SearchCriteria.Op.LIKE, "%" + "replace(" + domainHandle.getPath() + ", '%', '[%]')" + "%");
             List<DomainVO> domainsToBeInactivated = _domainDao.search(sc1, null);
 
+            // Validate that no Instance in this domain or its subdomains has delete protection
+            validateNoDeleteProtectedVmsForDomain(domainHandle, domainsToBeInactivated);
+
+            domainHandle.setState(Domain.State.Inactive);
+            _domainDao.update(domainId, domainHandle);
+
             // update all subdomains to inactive so no accounts/users can be created
             for (DomainVO domain : domainsToBeInactivated) {
                 domain.setState(Domain.State.Inactive);
@@ -729,8 +729,11 @@ protected boolean cleanupDomain(Long domainId, Long ownerId) throws ConcurrentOp
         return success && deleteDomainSuccess;
     }
 
-    private void validateNoDeleteProtectedVmsForDomainIds(Domain domainHandle, List<Long> domainIds) {
-        List<VMInstanceVO> deleteProtectedVms = vmInstanceDao.listDeleteProtectedVmsByDomainIds(domainIds);
+    private void validateNoDeleteProtectedVmsForDomain(Domain domainHandle, List<DomainVO> subDomains) {
+        List<Long> allDomainIds = subDomains.stream().map(Domain::getId).collect(Collectors.toList());
+        allDomainIds.add(domainHandle.getId());
+
+        List<VMInstanceVO> deleteProtectedVms = vmInstanceDao.listDeleteProtectedVmsByDomainIds(allDomainIds);
         if (deleteProtectedVms.isEmpty()) {
             return;
         }