Protect owner administration authority

2026-09-04 00:20:28 -04:00
parent 6f0b597943
commit d54d6a4ad1
10 changed files with 100 additions and 7 deletions
@@ -234,6 +234,15 @@ func (store *Store) ReplaceOrganizationUserRole(ctx context.Context, expected []
 	if len(currentRoles) == 1 && currentRoles[0] == replacement.Role {
 		return access.ErrRoleUnchanged
 	}
+	if replacement.Role == ownerRole || slices.Contains(currentRoles, ownerRole) {
+		actorIsOwner, ownerErr := hasDirectOwnerRole(ctx, tx, replacement.Scope.OrganizationID, replacement.GrantedBy, ownerRole)
+		if ownerErr != nil {
+			return ownerErr
+		}
+		if !actorIsOwner {
+			return access.ErrOwnerAuthority
+		}
+	}
 	if replacement.Role != ownerRole && slices.Contains(currentRoles, ownerRole) {
 		var otherOwners int
 		if err = tx.QueryRowContext(ctx, `SELECT COUNT(DISTINCT b.subject_id)