server-side protection against last category deletion

app/controllers/api/categories_controller.rb

@@ -31,8 +31,11 @@ class API::CategoriesController < API::ApiController
 
   def destroy
     authorize Category
-    @category.destroy
-    head :no_content
+    if @category.safe_destroy
+      head :no_content
+    else
+      render json: @category.errors, status: :unprocessable_entity
+    end
   end
 
   private

app/models/category.rb

@@ -1,3 +1,11 @@
 class Category < ActiveRecord::Base
   has_and_belongs_to_many :events, join_table: :events_categories, dependent: :destroy
+
+  def safe_destroy
+    if count > 1
+      destroy
+    else
+      false
+    end
+  end
 end