rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Only guard owner demotion for active profiles

Browse Source 
Move profile load before the owner-demotion guard and add
an active-state check, matching the RemoveUser pattern.
Without this, demoting an inactive owner would be
incorrectly blocked.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-04-20 12:23:29 +02:00
committed by Sacha Al Himdani
parent dd8c3b5491
commit f743c743c1
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/iam/organization_service.go
View File

@@ -266,7 +266,12 @@ func (s *OrganizationService) UpdateMempership(
return NewMembershipNotFoundError(membership.ID)
}
if membership.Role == coredata.MembershipRoleOwner && role != coredata.MembershipRoleOwner {
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, membership.IdentityID, membership.OrganizationID); err != nil {
return fmt.Errorf("cannot load profile: %w", err)
}
if membership.Role == coredata.MembershipRoleOwner && role != coredata.MembershipRoleOwner && profile.State == coredata.ProfileStateActive {
profiles := coredata.MembershipProfiles{}
count, err := profiles.CountActiveOwnerByOrganizationID(ctx, tx, scope, organizationID)
if err != nil {
@@ -285,11 +290,6 @@ func (s *OrganizationService) UpdateMempership(
return fmt.Errorf("cannot update membership: %w", err)
}
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, membership.IdentityID, membership.OrganizationID); err != nil {
return fmt.Errorf("cannot load profile: %w", err)
}
if err := webhook.InsertData(ctx, tx, scope, organizationID, coredata.WebhookEventTypeUserUpdated, webhooktypes.NewUser(profile, &membership)); err != nil {
return fmt.Errorf("cannot insert webhook event: %w", err)
}