Uh oh!
There was an error while loading. Please reload this page.
feat(web): add multi-owner support with promote/demote actions - #988
Merged
Conversation
Allow owners to promote members to owner and demote owners to member, enabling multiple owners per organization. This is gated behind the org-management entitlement as an enterprise feature. - Add promoteToOwner and demoteToMember server actions in ee/features/userManagement - Update leaveOrg to allow non-last owners to leave - Replace "Transfer ownership" UI with "Promote to owner" / "Demote to member" - Support self-demotion (with last-owner protection) - Deprecate transferOwnership action Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…upport - Update roles-and-permissions to document multiple owners and promote/demote workflows - Update access-settings to use plural owner references - Add new audit events: org.member_promoted_to_owner, org.owner_demoted_to_member Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Caution Review failedPull request was closed or merged during review WalkthroughAdds multi-owner support: replaces single ownership transfer with promote-to-owner and demote-to-member flows; introduces backend actions, UI changes, docs updates, new telemetry events, and new error codes to enforce multi-owner rules. Changes
Sequence Diagram(s)sequenceDiagram
participant Client as Client UI
participant Server as Server Actions
participant Auth as Auth & Entitlements
participant DB as Database
participant Audit as Audit Service
Client->>Server: promoteToOwner(memberId)
Server->>Auth: withAuthV2 + withMinimumOrgRole
Auth-->>Server: authenticated & role verified
Server->>Auth: hasEntitlement('org-management')
Auth-->>Server: entitlement granted
Server->>DB: fetch member, ensure not already OWNER
DB-->>Server: member record
Server->>DB: update role -> OWNER
DB-->>Server: update result
Server->>Audit: record promotion audit entry
Audit-->>Server: logged
Server-->>Client: { success: true }
Client->>Server: demoteToMember(memberId)
Server->>Auth: withAuthV2 + withMinimumOrgRole
Auth-->>Server: authenticated & role verified
Server->>Auth: hasEntitlement('org-management')
Auth-->>Server: entitlement granted
Server->>DB: verify target is OWNER and owners.count > 1
DB-->>Server: validation result
Server->>DB: update role -> MEMBER
DB-->>Server: update result
Server->>Audit: record demotion audit entry
Audit-->>Server: logged
Server-->>Client: { success: true }
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This comment has been minimized.
This comment has been minimized.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
packages/web/src/app/[domain]/settings/members/components/membersList.tsx (1)
247-257: Consider disabling "Demote to member" for the last owner in the UI.The "Leave organization" option at line 272 is correctly disabled when
ownerCount <= 1, but the "Demote to member" option doesn't have similar protection. While the server-side action will correctly reject demoting the last owner withLAST_OWNER_CANNOT_BE_DEMOTED, users will see the option, click it, go through the confirmation dialog, and only then receive an error.For consistency with the "Leave" behavior, consider disabling this option in the UI:
💡 Proposed UX improvement
- {hasOrgManagement && currentUserRole === OrgRole.OWNER && member.role === OrgRole.OWNER && (+ {hasOrgManagement && currentUserRole === OrgRole.OWNER && member.role === OrgRole.OWNER && (ownerCount > 1 || member.id !== currentUserId) && ( <DropdownMenuItem className="cursor-pointer" onClick={() => { setMemberToDemote(member); setIsDemoteDialogOpen(true); }} > Demote to member </DropdownMenuItem> )}Alternatively, you could use the
disabledprop similar to line 272 if you want to keep the option visible but non-interactive.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/web/src/app/`[domain]/settings/members/components/membersList.tsx around lines 247 - 257, The "Demote to member" action currently renders whenever hasOrgManagement && currentUserRole === OrgRole.OWNER && member.role === OrgRole.OWNER; update this to guard against demoting the last owner by including ownerCount > 1 in that condition (or render the DropdownMenuItem with disabled={ownerCount <= 1}) and keep the existing onClick behavior tied to setMemberToDemote and setIsDemoteDialogOpen; this mirrors the "Leave organization" behavior and prevents showing/allowing the demote flow for the final owner.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/docs/configuration/audit-logs.mdx`:
- Around line 147-150: The doc contains duplicate audit action rows for
org.ownership_transfer_failed and org.ownership_transferred; remove the repeated
entries from the block that currently lists `org.ownership_transfer_failed` and
`org.ownership_transferred` so only the new entries
`org.member_promoted_to_owner` and `org.owner_demoted_to_member` remain,
ensuring the audit actions table no longer repeats
`org.ownership_transfer_failed` and `org.ownership_transferred`.
In `@docs/docs/configuration/auth/roles-and-permissions.mdx`:
- Line 30: Replace the em dash in the sentence "The last remaining owner of an
organization cannot be demoted — at least one owner must exist at all times."
with alternative punctuation per docs guidelines; for example change it to two
sentences ("...cannot be demoted. At least one owner..."), or use a comma or
parentheses ("..., at least one owner..." or "...(at least one owner...)") so
the .mdx file no longer contains an em dash.
In `@packages/web/src/ee/features/userManagement/actions.ts`:
- Around line 111-136: The owner-count check and subsequent role update
(prisma.userToOrg.count -> ownerCount and prisma.userToOrg.update) are
vulnerable to a TOCTOU race; wrap the count+check+update in a single atomic
transaction and acquire a row-level lock first (e.g., SELECT ... FOR UPDATE on
the UserToOrg or Org row via prisma.$queryRaw or lock the org's membership rows)
so you re-check ownerCount inside the same transaction before performing the
update; apply the same pattern to the leaveOrg flow where the same
count-then-update logic exists.
---
Nitpick comments:
In `@packages/web/src/app/`[domain]/settings/members/components/membersList.tsx:
- Around line 247-257: The "Demote to member" action currently renders whenever
hasOrgManagement && currentUserRole === OrgRole.OWNER && member.role ===
OrgRole.OWNER; update this to guard against demoting the last owner by including
ownerCount > 1 in that condition (or render the DropdownMenuItem with
disabled={ownerCount <= 1}) and keep the existing onClick behavior tied to
setMemberToDemote and setIsDemoteDialogOpen; this mirrors the "Leave
organization" behavior and prevents showing/allowing the demote flow for the
final owner.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 61f8da61-9e37-4f13-900a-d175adbe2995
📒 Files selected for processing (10)
docs/docs/configuration/audit-logs.mdxdocs/docs/configuration/auth/access-settings.mdxdocs/docs/configuration/auth/roles-and-permissions.mdxpackages/web/src/actions.tspackages/web/src/app/[domain]/settings/members/components/membersList.tsxpackages/web/src/app/[domain]/settings/members/page.tsxpackages/web/src/ee/features/billing/components/manageSubscriptionButton.tsxpackages/web/src/ee/features/userManagement/actions.tspackages/web/src/lib/errorCodes.tspackages/web/src/lib/posthogEvents.ts
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
docs/docs/configuration/auth/roles-and-permissions.mdx (1)
38-38:⚠️ Potential issue | 🟡 MinorReplace the em dash in this sentence.
This line still uses
—, which violates the docs style rules.📝 Suggested fix
-To demote an owner, click the action menu next to their name and select **Demote to member**. Owners can also demote themselves to step down from the role. The last remaining owner of an organization cannot be demoted — at least one owner must exist at all times.+To demote an owner, click the action menu next to their name and select **Demote to member**. Owners can also demote themselves to step down from the role. The last remaining owner of an organization cannot be demoted. At least one owner must exist at all times.As per coding guidelines: "When writing or editing
.mdxfiles indocs/, do NOT use em dashes (—). Use periods to break sentences, commas, or parentheses instead."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/docs/configuration/auth/roles-and-permissions.mdx` at line 38, The sentence "The last remaining owner of an organization cannot be demoted — at least one owner must exist at all times." uses an em dash; replace the em dash with a period (or comma/parentheses) to follow docs style: e.g., split into two sentences "The last remaining owner of an organization cannot be demoted. At least one owner must exist at all times." Update the text in the roles-and-permissions paragraph accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/web/src/features/userManagement/actions.ts`:
- Line 5: The membership deletion currently calls decrementOrgSeatCount() inside
the DB transaction and "throw result" which leaks non-ServiceError exceptions;
move the external billing call (decrementOrgSeatCount) out of the transaction so
the DB delete and local seat-count update are committed first and then call
decrementOrgSeatCount in a post-commit/retriable job; when propagating failures
from the billing call wrap them into the ServiceErrorException (or a
ServiceError) instead of rethrowing the raw result so sew() can unwrap them
correctly (refer to decrementOrgSeatCount, sew, ServiceError and
ServiceErrorException in your changes).
- Around line 14-48: The mutation removeMemberFromOrg currently deletes a
userToOrg row without protecting the "last owner" invariant; fix it by
performing the owner-check inside the same prisma.$transaction that does the
delete: inside the transaction (use the tx instance) first fetch the
targetMember (or check targetMember.role) and if targetMember.role ===
OrgRole.OWNER then call tx.userToOrg.count({ where: { orgId: org.id, role:
OrgRole.OWNER } }) and if that count <= 1 abort (return or throw a ServiceError
indicating the org cannot be left without an owner) instead of deleting; only
proceed to tx.userToOrg.delete and then call decrementOrgSeatCount(tx) afterward
if not aborted. Apply the same in the related code path referenced (the 52-87
block / leaveOrg logic) to ensure the invariant is enforced inside the
transactional write.
---
Duplicate comments:
In `@docs/docs/configuration/auth/roles-and-permissions.mdx`:
- Line 38: The sentence "The last remaining owner of an organization cannot be
demoted — at least one owner must exist at all times." uses an em dash; replace
the em dash with a period (or comma/parentheses) to follow docs style: e.g.,
split into two sentences "The last remaining owner of an organization cannot be
demoted. At least one owner must exist at all times." Update the text in the
roles-and-permissions paragraph accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5d7cd23b-479b-4ae5-84f5-f05141a327c8
⛔ Files ignored due to path filters (4)
docs/images/demote_to_member.pngis excluded by!**/*.pngdocs/images/managing_owners.pngis excluded by!**/*.pngdocs/images/owner_leave_org.pngis excluded by!**/*.pngdocs/images/promote_to_owner.pngis excluded by!**/*.png
📒 Files selected for processing (5)
docs/docs/configuration/audit-logs.mdxdocs/docs/configuration/auth/roles-and-permissions.mdxpackages/web/src/actions.tspackages/web/src/app/[domain]/settings/members/components/membersList.tsxpackages/web/src/features/userManagement/actions.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/docs/configuration/audit-logs.mdx
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allow owners to promote members to owner and demote owners to member, enabling multiple owners per organization. This is gated behind the org-management entitlement as an enterprise feature.
Fixes#816
Summary by CodeRabbit
New Features
Documentation
Improvements