zhi/HarborForge.Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent deleting project owner

Browse Source
This commit is contained in:
Zhi
2026-03-12 12:47:15 +00:00
parent d1f9129922
commit 50f5e360e4
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/api/routers/projects.py
View File

@@ -304,6 +304,18 @@ def remove_project_member(
member = db.query(models.ProjectMember).filter( member = db.query(models.ProjectMember).filter(
models.ProjectMember.project_id == project_id, models.ProjectMember.user_id == user_id models.ProjectMember.project_id == project_id, models.ProjectMember.user_id == user_id
).first() ).first()
# Prevent removing project owner (admin role)
if member.role_id:
role = db.query(Role).filter(Role.id == member.role_id).first()
if role and role.name == "admin":
# Check if this is the only admin
admin_count = db.query(models.ProjectMember).filter(
models.ProjectMember.project_id == project_id,
models.ProjectMember.role_id == member.role_id
).count()
if admin_count <= 1:
raise HTTPException(status_code=400, detail="Cannot remove the last owner of the project")
if not member: if not member:
raise HTTPException(status_code=404, detail="Member not found") raise HTTPException(status_code=404, detail="Member not found")
db.delete(member) db.delete(member)