Enforce at least one owner

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/errors.go

@@ -147,6 +147,18 @@ func (e ErrMembershipManagedBySCIM) Error() string {
 	return fmt.Sprintf("membership %q is managed by SCIM and cannot be deleted manually", e.MembershipID)
 }
 
+type ErrLastActiveOwner struct {
+	MembershipID gid.GID
+}
+
+func NewLastActiveOwnerError(membershipID gid.GID) error {
+	return &ErrLastActiveOwner{MembershipID: membershipID}
+}
+
+func (e ErrLastActiveOwner) Error() string {
+	return fmt.Sprintf("cannot remove membership %q: last active owner of the organization", e.MembershipID)
+}
+
 type ErrOrganizationNotFound struct{ OrganizationID gid.GID }
 
 func NewOrganizationNotFoundError(organizationID gid.GID) error {

pkg/iam/organization_service.go

@@ -257,6 +257,21 @@ func (s *OrganizationService) RemoveMember(
 				return NewMembershipManagedBySCIMError(membershipID)
 			}
 
+			if membership.Role == coredata.MembershipRoleOwner && membership.State == coredata.MembershipStateActive {
+				memberships := coredata.Memberships{}
+				filter := coredata.NewMembershipFilter().
+					WithRole(coredata.MembershipRoleOwner).
+					WithState(coredata.MembershipStateActive)
+				count, err := memberships.CountByOrganizationID(ctx, tx, scope, organizationID, filter)
+				if err != nil {
+					return fmt.Errorf("cannot count active owners: %w", err)
+				}
+
+				if count <= 1 {
+					return NewLastActiveOwnerError(membershipID)
+				}
+			}
+
 			err := membership.Delete(ctx, tx, scope, membershipID)
 			if err != nil {
 				return fmt.Errorf("cannot delete membership: %w", err)