diff --git a/app/api/routers/projects.py b/app/api/routers/projects.py index 799b0a2..0424275 100644 --- a/app/api/routers/projects.py +++ b/app/api/routers/projects.py @@ -304,6 +304,18 @@ def remove_project_member( member = db.query(models.ProjectMember).filter( models.ProjectMember.project_id == project_id, models.ProjectMember.user_id == user_id ).first() + + # Prevent removing project owner (admin role) + if member.role_id: + role = db.query(Role).filter(Role.id == member.role_id).first() + if role and role.name == "admin": + # Check if this is the only admin + admin_count = db.query(models.ProjectMember).filter( + models.ProjectMember.project_id == project_id, + models.ProjectMember.role_id == member.role_id + ).count() + if admin_count <= 1: + raise HTTPException(status_code=400, detail="Cannot remove the last owner of the project") if not member: raise HTTPException(status_code=404, detail="Member not found") db.delete(member)