fix: enforce last-member guard atomically in removeTeamMember

Author: nicktrn

apps/webapp/app/models/member.server.ts

@@ -92,24 +92,38 @@ export async function removeTeamMember({
     throw new ServiceValidationError("User does not have access to this organization", 403);
   }
 
-  // Scope the target to this org. A member id is a globally unique key, so
-  // deleting by id alone would remove members of other orgs; bind it to the
-  // resolved org and reject a foreign id.
-  const member = await prisma.orgMember.findFirst({
-    where: { id: memberId, organizationId: org.id },
-    include: {
-      organization: true,
-      user: true,
-    },
-  });
+  // Serializable: the "keep at least one member" check and the delete must not
+  // interleave with a concurrent removal, or two requests could each pass the
+  // count and leave the org with zero members. Guard lives here (not per-caller)
+  // so the dashboard and the management API both get it.
+  return prisma.$transaction(
+    async (tx) => {
+      // Scope the target to this org. A member id is a globally unique key, so
+      // deleting by id alone would remove members of other orgs; bind it to the
+      // resolved org and reject a foreign id.
+      const member = await tx.orgMember.findFirst({
+        where: { id: memberId, organizationId: org.id },
+        include: {
+          organization: true,
+          user: true,
+        },
+      });
 
-  if (!member) {
-    throw new ServiceValidationError("Member not found in this organization", 404);
-  }
+      if (!member) {
+        throw new ServiceValidationError("Member not found in this organization", 404);
+      }
 
-  await prisma.orgMember.delete({ where: { id: member.id } });
+      const memberCount = await tx.orgMember.count({ where: { organizationId: org.id } });
+      if (memberCount <= 1) {
+        throw new ServiceValidationError("Cannot remove the last member of an organization", 400);
+      }
 
-  return member;
+      await tx.orgMember.delete({ where: { id: member.id } });
+
+      return member;
+    },
+    { isolationLevel: PrismaNamespace.TransactionIsolationLevel.Serializable }
+  );
 }
 
 export async function inviteMembers({

apps/webapp/app/routes/api.v1.orgs.$orgParam.members.$memberId.ts

@@ -36,17 +36,9 @@ export const action = createActionPATApiRoute(
       return json({ error: "Organization not found" }, { status: 404 });
     }
 
-    // An org must keep at least one member. The dashboard guards this in the
-    // UI only; enforce it here since removeTeamMember doesn't.
-    const memberCount = await prisma.orgMember.count({
-      where: { organizationId: organization.id },
-    });
-    if (memberCount <= 1) {
-      return json({ error: "Cannot remove the last member of an organization" }, { status: 400 });
-    }
-
-    // removeTeamMember throws ServiceValidationError; the builder maps it to
-    // its status (e.g. 404 for a member not in this org).
+    // removeTeamMember enforces the last-member guard and throws
+    // ServiceValidationError (member-not-found / last-member), which the
+    // builder maps to its status.
     const removed = await removeTeamMember({
       userId: authentication.userId,
       slug: organization.slug,

apps/webapp/test/auth-api.e2e.full.test.ts

@@ -3016,4 +3016,24 @@ describe("API", () => {
       expect(res.status).not.toBe(405);
     });
   });
+
+  // Member removal via the PAT action route. The last-member guard lives in
+  // removeTeamMember and surfaces as a ServiceValidationError the builder maps
+  // to 400 — so an org can't be emptied of its only member.
+  describe("Member removal — last-member guard", () => {
+    it("removing the last member is rejected: 400", async () => {
+      const server = getTestServer();
+      const { user, organization, pat } = await seedTestUserProject(server.prisma);
+      const member = await server.prisma.orgMember.findFirst({
+        where: { organizationId: organization.id, userId: user.id },
+      });
+      if (!member) throw new Error("seed did not create an org member");
+
+      const res = await server.webapp.fetch(
+        `/api/v1/orgs/${organization.id}/members/${member.id}`,
+        { method: "DELETE", headers: { Authorization: `Bearer ${pat.token}` } }
+      );
+      expect(res.status).toBe(400);
+    });
+  });
 });