fix: memberships patch and delete logic.

appwrite · Meldiron · Jun 8, 2025 · Jun 9, 2025 · Jun 9, 2025 · Jun 9, 2025
commit 856a9a714b4923f79cffe7b235bf842829cb167c
diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
@@ -1096,9 +1096,12 @@
                max: 2
            );

+            // Is the role change being requested by the user on their own membership?
+            $isCurrentUserAnOwner =  $user->getInternalId() === $membership->getAttribute('userInternalId');
+
            // Prevent role change if there's only one owner left,
-            // the requester is that owner, and the new `$roles` no longer include 'owner'!
-            if ($ownersCount === 1 && $isOwner && !\in_array('owner', $roles)) {
+            // the requester is that owner, and the new `$roles` no longer include 'owner'
+            if ($ownersCount === 1 && $isOwner && $isCurrentUserAnOwner && !\in_array('owner', $roles)) {
                throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'There must be at least one owner in the organization.');
            }
        }
@@ -1314,21 +1317,22 @@
    ))
    ->param('teamId', '', new UID(), 'Team ID.')
    ->param('membershipId', '', new UID(), 'Membership ID.')
+    ->inject('user')
    ->inject('project')
    ->inject('response')
    ->inject('dbForProject')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, Document $project, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents) {

        $membership = $dbForProject->getDocument('memberships', $membershipId);

        if ($membership->isEmpty()) {
            throw new Exception(Exception::TEAM_INVITE_NOT_FOUND);
        }

-        $user = $dbForProject->getDocument('users', $membership->getAttribute('userId'));
+        $profile = $dbForProject->getDocument('users', $membership->getAttribute('userId'));

-        if ($user->isEmpty()) {
+        if ($profile->isEmpty()) {
            throw new Exception(Exception::USER_NOT_FOUND);
        }

@@ -1354,7 +1358,10 @@
                max: 2
            );

-            if ($ownersCount === 1) {
+            // Is the deletion being requested by the user on their own membership?
+            $isCurrentUserAnOwner =  $user->getInternalId() === $membership->getAttribute('userInternalId');
+
+            if ($ownersCount === 1 && $isCurrentUserAnOwner) {
                /* Prevent removal if the user is the only owner. */
                throw new Exception(
                    Exception::GENERAL_ARGUMENT_INVALID,
@@ -1378,8 +1385,8 @@
        }

        $queueForEvents
-            ->setParam('userId', $user->getId())
            ->setParam('teamId', $team->getId())
+            ->setParam('userId', $profile->getId())
            ->setParam('membershipId', $membership->getId())
            ->setPayload($response->output($membership, Response::MODEL_MEMBERSHIP))
        ;