fix(webapp): centralize the last-member guard in removeTeamMember

removeTeamMember now lives in its own leaf module with an org-scoped delete.
Add an atomic (Serializable) guard so an organization can't be left with zero
members, enforced centrally for both the dashboard team page and the management
API. It throws ServiceValidationError (404 member-not-found, 400 last-member) so
the PAT action builder maps the response status; existing messages are unchanged
so the model's tests still hold. The API members route imports the relocated
module and passes the prisma client, and drops its own now-removed copy plus the
now-unused imports.

Author: nicktrn

apps/webapp/app/models/member.server.ts

@@ -1,12 +1,11 @@
 import type { Organization, OrgMember, Project } from "@trigger.dev/database";
-import { Prisma as PrismaNamespace, type Prisma, prisma, $transaction } from "~/db.server";
+import { Prisma as PrismaNamespace, type Prisma, prisma } from "~/db.server";
 import { createEnvironment } from "./organization.server";
 import { customAlphabet } from "nanoid";
 import { logger } from "~/services/logger.server";
 import { getDefaultEnvironmentConcurrencyLimit } from "~/services/platform.v3.server";
 import { rbac } from "~/services/rbac.server";
 import { ssoController } from "~/services/sso.server";
-import { ServiceValidationError } from "~/v3/services/common.server";
 
 export const INVITE_NOT_FOUND = "Invite not found";
 export const INVITE_BLOCKED_DIRECTORY_MANAGED =

apps/webapp/app/models/removeTeamMember.server.ts

@@ -1,8 +1,10 @@
 import type { PrismaClient } from "@trigger.dev/database";
+import { ServiceValidationError } from "~/v3/services/common.server";
 
 // Leaf module with a type-only Prisma import (caller passes the client) so it
 // can be unit-tested without importing `~/db.server`, which eagerly connects
-// the global prisma singleton.
+// the global prisma singleton. ServiceValidationError is a plain error class
+// with no imports, so it stays leaf-safe and lets callers map it to a status.
 export async function removeTeamMember(
   {
     userId,
@@ -20,22 +22,38 @@ export async function removeTeamMember(
   });
 
   if (!org) {
-    throw new Error("User does not have access to this organization");
+    throw new ServiceValidationError("User does not have access to this organization", 403);
   }
 
-  // Scope both the lookup and the delete to org.id, in a transaction, so the
-  // member id is only ever resolved within the actor's organization.
-  return prismaClient.$transaction(async (tx) => {
-    const target = await tx.orgMember.findFirst({
-      where: { id: memberId, organizationId: org.id },
-      include: { organization: true, user: true },
-    });
+  // Serializable so the "keep at least one member" check and the delete are
+  // atomic: at ReadCommitted two concurrent removals could each see >1 member
+  // and both delete, orphaning the org. The guard lives here, not per-caller,
+  // so every surface (dashboard + management API) is TOCTOU-safe. Raw
+  // $transaction (not the ~/db.server helper) keeps this module leaf/testable.
+  return prismaClient.$transaction(
+    async (tx) => {
+      // Scope both the lookup and the delete to org.id, so the member id is
+      // only ever resolved within the actor's organization.
+      const target = await tx.orgMember.findFirst({
+        where: { id: memberId, organizationId: org.id },
+        include: { organization: true, user: true },
+      });
 
-    if (!target) {
-      throw new Error("Member not found in this organization");
-    }
+      if (!target) {
+        throw new ServiceValidationError("Member not found in this organization", 404);
+      }
 
-    await tx.orgMember.delete({ where: { id: target.id } });
-    return target;
-  });
+      const memberCount = await tx.orgMember.count({ where: { organizationId: org.id } });
+      if (memberCount <= 1) {
+        throw new ServiceValidationError(
+          "Cannot remove the last member of an organization",
+          400
+        );
+      }
+
+      await tx.orgMember.delete({ where: { id: target.id } });
+      return target;
+    },
+    { isolationLevel: "Serializable" }
+  );
 }

apps/webapp/app/routes/api.v1.orgs.$orgParam.members.$memberId.ts

@@ -1,7 +1,7 @@
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { prisma } from "~/db.server";
-import { removeTeamMember } from "~/models/member.server";
+import { removeTeamMember } from "~/models/removeTeamMember.server";
 import { resolveOrganizationForApiUser } from "~/services/organizationApiAccess.server";
 import { createActionPATApiRoute } from "~/services/routeBuilders/apiBuilder.server";
 import { ssoController } from "~/services/sso.server";
@@ -44,14 +44,17 @@ export const action = createActionPATApiRoute(
       return json({ error: "Membership is managed by Directory Sync" }, { status: 403 });
     }
 
-    // removeTeamMember enforces the last-member guard and throws
-    // ServiceValidationError (member-not-found / last-member), which the
-    // builder maps to its status.
-    const removed = await removeTeamMember({
-      userId: authentication.userId,
-      slug: organization.slug,
-      memberId: params.memberId,
-    });
+    // Org-scoped, TOCTOU-safe delete shared with the dashboard Team page. The
+    // model throws ServiceValidationError (member-not-found 404, last-member
+    // guard 400), which the builder maps to the response status.
+    const removed = await removeTeamMember(
+      {
+        userId: authentication.userId,
+        slug: organization.slug,
+        memberId: params.memberId,
+      },
+      prisma
+    );
 
     // Sticky removal: record a tombstone so passive SSO-JIT won't re-add them
     // (best-effort; no-op without the SSO plugin).

apps/webapp/test/removeTeamMember.test.ts

@@ -155,4 +155,34 @@ describe("removeTeamMember", () => {
       ).rejects.toThrow("Member not found in this organization");
     }
   );
+
+  containerTest(
+    "refuses to remove the sole member (last-member guard, locks the message)",
+    async ({ prisma }) => {
+      const slug = `orgsolo_${Math.random().toString(36).slice(2, 10)}`;
+      const soloUser = await prisma.user.create({
+        data: { email: `solo_${slug}@example.com`, authenticationMethod: "MAGIC_LINK" },
+      });
+      const organization = await prisma.organization.create({
+        data: {
+          title: slug,
+          slug,
+          members: { create: { userId: soloUser.id, role: "ADMIN" } },
+        },
+        include: { members: true },
+      });
+      const soloMember = organization.members[0];
+
+      await expect(
+        removeTeamMember(
+          { userId: soloUser.id, slug: organization.slug, memberId: soloMember.id },
+          prisma
+        )
+      ).rejects.toThrow("Cannot remove the last member of an organization");
+
+      const stillThere = await prisma.orgMember.findUnique({ where: { id: soloMember.id } });
+      expect(stillThere).not.toBeNull();
+    }
+  );
+
 });