feat: allow admins to remove organisation and team members (#2705)

packages/trpc/server/admin-router/delete-organisation-member.ts

@@ -0,0 +1,126 @@
+import { OrganisationMemberInviteStatus } from '@prisma/client';
+
+import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { jobs } from '@documenso/lib/jobs/client';
+import { prisma } from '@documenso/prisma';
+
+import { adminProcedure } from '../trpc';
+import {
+  ZDeleteAdminOrganisationMemberRequestSchema,
+  ZDeleteAdminOrganisationMemberResponseSchema,
+} from './delete-organisation-member.types';
+
+export const deleteAdminOrganisationMemberRoute = adminProcedure
+  .input(ZDeleteAdminOrganisationMemberRequestSchema)
+  .output(ZDeleteAdminOrganisationMemberResponseSchema)
+  .mutation(async ({ ctx, input }) => {
+    const { organisationId, organisationMemberId } = input;
+
+    ctx.logger.info({
+      input: {
+        organisationId,
+        organisationMemberId,
+      },
+    });
+
+    const organisation = await prisma.organisation.findUnique({
+      where: {
+        id: organisationId,
+      },
+      include: {
+        subscription: true,
+        organisationClaim: true,
+        teams: {
+          select: {
+            id: true,
+          },
+        },
+        members: {
+          select: {
+            id: true,
+            userId: true,
+          },
+        },
+        invites: {
+          where: {
+            status: OrganisationMemberInviteStatus.PENDING,
+          },
+          select: {
+            id: true,
+          },
+        },
+      },
+    });
+
+    if (!organisation) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Organisation not found',
+      });
+    }
+
+    const memberToDelete = organisation.members.find(
+      (member) => member.id === organisationMemberId,
+    );
+
+    if (!memberToDelete) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Member not found in this organisation',
+      });
+    }
+
+    if (memberToDelete.userId === organisation.ownerUserId) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, {
+        message: 'Cannot remove the organisation owner. Transfer ownership first.',
+      });
+    }
+
+    const newMemberCount = organisation.members.length + organisation.invites.length - 1;
+
+    // Removing a member is a reducing operation, so we don't gate it on the
+    // subscription being present. Sync Stripe only when one exists.
+    if (organisation.subscription) {
+      await syncMemberCountWithStripeSeatPlan(
+        organisation.subscription,
+        organisation.organisationClaim,
+        newMemberCount,
+      );
+    }
+
+    const teamIds = organisation.teams.map((team) => team.id);
+
+    await prisma.$transaction(async (tx) => {
+      // Removing an OrganisationMember cascades the user out of every team in
+      // the org via OrganisationGroupMember, but their authored Envelope rows
+      // still reference them. Reassign those to the org owner so they remain
+      // reachable after the member loses access (mirrors delete-user.ts).
+      if (teamIds.length > 0) {
+        await tx.envelope.updateMany({
+          where: {
+            userId: memberToDelete.userId,
+            teamId: {
+              in: teamIds,
+            },
+          },
+          data: {
+            userId: organisation.ownerUserId,
+          },
+        });
+      }
+
+      await tx.organisationMember.delete({
+        where: {
+          id: organisationMemberId,
+          organisationId,
+        },
+      });
+    });
+
+    await jobs.triggerJob({
+      name: 'send.organisation-member-left.email',
+      payload: {
+        organisationId,
+        memberUserId: memberToDelete.userId,
+      },
+    });
+  });

packages/trpc/server/admin-router/delete-organisation-member.types.ts

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+
+export const ZDeleteAdminOrganisationMemberRequestSchema = z.object({
+  organisationId: z.string().min(1),
+  organisationMemberId: z.string().min(1),
+});
+
+export const ZDeleteAdminOrganisationMemberResponseSchema = z.void();
+
+export type TDeleteAdminOrganisationMemberRequest = z.infer<
+  typeof ZDeleteAdminOrganisationMemberRequestSchema
+>;
+export type TDeleteAdminOrganisationMemberResponse = z.infer<
+  typeof ZDeleteAdminOrganisationMemberResponseSchema
+>;

packages/trpc/server/admin-router/delete-team-member.ts

@@ -0,0 +1,106 @@
+import { OrganisationGroupType } from '@prisma/client';
+
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+import { adminProcedure } from '../trpc';
+import {
+  ZDeleteAdminTeamMemberRequestSchema,
+  ZDeleteAdminTeamMemberResponseSchema,
+} from './delete-team-member.types';
+
+export const deleteAdminTeamMemberRoute = adminProcedure
+  .input(ZDeleteAdminTeamMemberRequestSchema)
+  .output(ZDeleteAdminTeamMemberResponseSchema)
+  .mutation(async ({ ctx, input }) => {
+    const { teamId, memberId } = input;
+
+    ctx.logger.info({
+      input: {
+        teamId,
+        memberId,
+      },
+    });
+
+    const team = await prisma.team.findUnique({
+      where: {
+        id: teamId,
+      },
+      include: {
+        organisation: {
+          select: {
+            ownerUserId: true,
+          },
+        },
+        teamGroups: {
+          where: {
+            organisationGroup: {
+              type: OrganisationGroupType.INTERNAL_TEAM,
+              organisationGroupMembers: {
+                some: {
+                  organisationMember: {
+                    id: memberId,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    if (!team) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Team not found',
+      });
+    }
+
+    const teamGroupToRemoveMemberFrom = team.teamGroups[0];
+
+    if (!teamGroupToRemoveMemberFrom) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message:
+          'Member is not directly assigned to this team. Inherited members cannot be removed here.',
+      });
+    }
+
+    const member = await prisma.organisationMember.findUnique({
+      where: {
+        id: memberId,
+      },
+      select: {
+        userId: true,
+      },
+    });
+
+    if (!member) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Member not found',
+      });
+    }
+
+    await prisma.$transaction(async (tx) => {
+      // Removing a user from a single team drops their INTERNAL_TEAM
+      // OrganisationGroupMember link, but Envelope rows they authored in this
+      // team still point at their userId. Reassign to the org owner so those
+      // envelopes remain reachable after the member loses team access.
+      await tx.envelope.updateMany({
+        where: {
+          userId: member.userId,
+          teamId,
+        },
+        data: {
+          userId: team.organisation.ownerUserId,
+        },
+      });
+
+      await tx.organisationGroupMember.delete({
+        where: {
+          organisationMemberId_groupId: {
+            organisationMemberId: memberId,
+            groupId: teamGroupToRemoveMemberFrom.organisationGroupId,
+          },
+        },
+      });
+    });
+  });

packages/trpc/server/admin-router/delete-team-member.types.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+
+export const ZDeleteAdminTeamMemberRequestSchema = z.object({
+  teamId: z.number().min(1),
+  memberId: z.string().min(1),
+});
+
+export const ZDeleteAdminTeamMemberResponseSchema = z.void();
+
+export type TDeleteAdminTeamMemberRequest = z.infer<typeof ZDeleteAdminTeamMemberRequestSchema>;
+export type TDeleteAdminTeamMemberResponse = z.infer<typeof ZDeleteAdminTeamMemberResponseSchema>;

packages/trpc/server/admin-router/router.ts

@@ -3,7 +3,9 @@ import { createAdminOrganisationRoute } from './create-admin-organisation';
 import { createStripeCustomerRoute } from './create-stripe-customer';
 import { createSubscriptionClaimRoute } from './create-subscription-claim';
 import { deleteDocumentRoute } from './delete-document';
+import { deleteAdminOrganisationMemberRoute } from './delete-organisation-member';
 import { deleteSubscriptionClaimRoute } from './delete-subscription-claim';
+import { deleteAdminTeamMemberRoute } from './delete-team-member';
 import { deleteUserRoute } from './delete-user';
 import { disableUserRoute } from './disable-user';
 import { downloadDocumentAuditLogsRoute } from './download-document-audit-logs';
@@ -44,6 +46,7 @@ export const adminRouter = router({
   organisationMember: {
     promoteToOwner: promoteMemberToOwnerRoute,
     updateRole: updateOrganisationMemberRoleRoute,
+    delete: deleteAdminOrganisationMemberRoute,
   },
   claims: {
     find: findSubscriptionClaimsRoute,
@@ -86,5 +89,8 @@ export const adminRouter = router({
   team: {
     get: getAdminTeamRoute,
   },
+  teamMember: {
+    delete: deleteAdminTeamMemberRoute,
+  },
   updateSiteSetting: updateSiteSettingRoute,
 });

packages/trpc/server/team-router/delete-team-member.ts

@@ -34,6 +34,11 @@ export const deleteTeamMemberRoute = authenticatedProcedure
         roles: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
       }),
       include: {
+        organisation: {
+          select: {
+            ownerUserId: true,
+          },
+        },
         teamGroups: {
           where: {
             organisationGroup: {
@@ -106,12 +111,39 @@ export const deleteTeamMemberRoute = authenticatedProcedure
       });
     }
 
-    await prisma.organisationGroupMember.delete({
-      where: {
-        organisationMemberId_groupId: {
-          organisationMemberId: memberId,
-          groupId: teamGroupToRemoveMemberFrom.organisationGroupId,
+    const removedMember =
+      teamGroupToRemoveMemberFrom.organisationGroup.organisationGroupMembers.find(
+        (ogm) => ogm.organisationMember.id === memberId,
+      );
+
+    if (!removedMember) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Member not found in this team',
+      });
+    }
+
+    await prisma.$transaction(async (tx) => {
+      // Removing a user from a single team drops their INTERNAL_TEAM
+      // OrganisationGroupMember link, but Envelope rows they authored in this
+      // team still point at their userId. Reassign to the org owner so those
+      // envelopes remain reachable after the member loses team access.
+      await tx.envelope.updateMany({
+        where: {
+          userId: removedMember.organisationMember.userId,
+          teamId,
         },
-      },
+        data: {
+          userId: team.organisation.ownerUserId,
+        },
+      });
+
+      await tx.organisationGroupMember.delete({
+        where: {
+          organisationMemberId_groupId: {
+            organisationMemberId: memberId,
+            groupId: teamGroupToRemoveMemberFrom.organisationGroupId,
+          },
+        },
+      });
     });
   });