fix(organizations): refuse transfer-and-leave for directory-managed owners

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/transfer-ownership/route.ts

@@ -81,8 +81,15 @@ export const POST = withRouteHandler(
         organizationId,
         currentOwnerUserId: session.user.id,
         newOwnerUserId,
+        currentOwnerLeaves: alsoLeave,
       })
 
+      if (transferResult.refusalCode) {
+        return NextResponse.json(
+          { error: transferResult.error, details: { code: transferResult.refusalCode } },
+          { status: 403 }
+        )
+      }
       if (!transferResult.success) {
         return NextResponse.json(
           { error: transferResult.error ?? 'Failed to transfer ownership' },
@@ -149,6 +156,7 @@ export const POST = withRouteHandler(
         userId: session.user.id,
         organizationId,
         memberId: selfMember.id,
+        actorUserId: session.user.id,
         spareSessionToken: session.session.token,
       })
       deliverRunStops(removeResult.stoppedRuns)

apps/sim/ee/scim/lib/managed-membership.integration.ts

@@ -19,7 +19,9 @@ async function loadRuntime() {
       import('@/ee/scim/lib/managed-membership'),
       import('@/ee/scim/lib/entitlement'),
     ])
-  const { removeOrganizationMemberRecord } = await import('@/lib/organizations/member-manager')
+  const [{ removeOrganizationMemberRecord }, { transferOrganizationOwnership }] = await Promise.all(
+    [import('@/lib/organizations/member-manager'), import('@/lib/billing/organizations/membership')]
+  )
   return {
     db,
     schema,
@@ -29,6 +31,7 @@ async function loadRuntime() {
     sql,
     alias,
     removeOrganizationMemberRecord,
+    transferOrganizationOwnership,
     ...membership,
     ...entitlement,
   }
@@ -269,4 +272,50 @@ describe('SCIM managed membership in PostgreSQL', () => {
       expect(await isMember(unmanagedUserId)).toBe(false)
     })
   })
+
+  describe('transferring ownership', () => {
+    beforeEach(async () => {
+      const { db, schema } = runtime
+      await db.insert(schema.member).values([
+        { id: generateId(), organizationId: orgId, userId: managedUserId, role: 'owner' },
+        { id: generateId(), organizationId: orgId, userId: adminUserId, role: 'member' },
+      ])
+    })
+
+    async function roleOf(userId: string) {
+      const { db, schema, and, eq } = runtime
+      const [row] = await db
+        .select({ role: schema.member.role })
+        .from(schema.member)
+        .where(and(eq(schema.member.organizationId, orgId), eq(schema.member.userId, userId)))
+      return row?.role
+    }
+
+    it('refuses a managed owner transferring to leave, leaving ownership unchanged', async () => {
+      const { transferOrganizationOwnership } = runtime
+      await expect(
+        transferOrganizationOwnership({
+          organizationId: orgId,
+          currentOwnerUserId: managedUserId,
+          newOwnerUserId: adminUserId,
+          currentOwnerLeaves: true,
+        })
+      ).resolves.toMatchObject({ success: false, refusalCode: 'SCIM_MANAGED_MEMBERSHIP' })
+      expect(await roleOf(managedUserId)).toBe('owner')
+      expect(await roleOf(adminUserId)).toBe('member')
+    })
+
+    it('lets a managed owner transfer ownership and stay', async () => {
+      const { transferOrganizationOwnership } = runtime
+      await expect(
+        transferOrganizationOwnership({
+          organizationId: orgId,
+          currentOwnerUserId: managedUserId,
+          newOwnerUserId: adminUserId,
+        })
+      ).resolves.toMatchObject({ success: true })
+      expect(await roleOf(managedUserId)).toBe('admin')
+      expect(await roleOf(adminUserId)).toBe('owner')
+    })
+  })
 })

apps/sim/lib/billing/organizations/membership.ts

@@ -52,6 +52,7 @@ import {
   enqueueCancelAtPeriodEndSync,
   isCancelAtPeriodEndSettled,
 } from '@/lib/billing/webhooks/subscription-sync'
+import { type ForbiddenDetailCode, ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { enqueueOutboxEvent } from '@/lib/core/outbox/service'
@@ -1836,11 +1837,19 @@ export interface TransferOwnershipParams {
   organizationId: string
   currentOwnerUserId: string
   newOwnerUserId: string
+  /**
+   * The current owner leaves once the transfer commits. Their self-leave is
+   * vetted inside the transfer, so a leave the directory would undo refuses the
+   * transfer too instead of half-applying it.
+   */
+  currentOwnerLeaves?: boolean
 }
 
 export interface TransferOwnershipResult {
   success: boolean
   error?: string
+  /** Set when the transfer was refused by policy rather than failed. */
+  refusalCode?: ForbiddenDetailCode
   workspacesReassigned: number
   billedAccountReassigned: number
   overageMigrated: string
@@ -1850,7 +1859,7 @@ export interface TransferOwnershipResult {
 export async function transferOrganizationOwnership(
   params: TransferOwnershipParams
 ): Promise<TransferOwnershipResult> {
-  const { organizationId, currentOwnerUserId, newOwnerUserId } = params
+  const { organizationId, currentOwnerUserId, newOwnerUserId, currentOwnerLeaves } = params
 
   const result: TransferOwnershipResult = {
     success: false,
@@ -1883,6 +1892,12 @@ export async function transferOrganizationOwnership(
       if (!currentOwnerMember) {
         throw new Error('Current user is not the owner of this organization')
       }
+      if (currentOwnerLeaves)
+        await assertSelfLeaveNotScimManaged({
+          organizationId,
+          userId: currentOwnerUserId,
+          executor: tx,
+        })
 
       const [newOwnerMember] = await tx
         .select({ id: member.id, role: member.role })
@@ -2052,6 +2067,8 @@ export async function transferOrganizationOwnership(
 
     return { ...result, success: true }
   } catch (error) {
+    if (error instanceof ForbiddenOperationError)
+      return { ...result, error: error.message, refusalCode: error.detailCode }
     logger.error('Failed to transfer organization ownership', {
       organizationId,
       currentOwnerUserId,