fix: prevent deleting project owner
This commit is contained in:
@@ -304,6 +304,18 @@ def remove_project_member(
|
||||
member = db.query(models.ProjectMember).filter(
|
||||
models.ProjectMember.project_id == project_id, models.ProjectMember.user_id == user_id
|
||||
).first()
|
||||
|
||||
# Prevent removing project owner (admin role)
|
||||
if member.role_id:
|
||||
role = db.query(Role).filter(Role.id == member.role_id).first()
|
||||
if role and role.name == "admin":
|
||||
# Check if this is the only admin
|
||||
admin_count = db.query(models.ProjectMember).filter(
|
||||
models.ProjectMember.project_id == project_id,
|
||||
models.ProjectMember.role_id == member.role_id
|
||||
).count()
|
||||
if admin_count <= 1:
|
||||
raise HTTPException(status_code=400, detail="Cannot remove the last owner of the project")
|
||||
if not member:
|
||||
raise HTTPException(status_code=404, detail="Member not found")
|
||||
db.delete(member)
|
||||
|
||||
Reference in New Issue
Block a user