[waleedlatif1]

Summary

• Any non-owner can now leave an organization from Members, but in an organization whose active directory connection locks manual membership, a self-leave succeeded and the next IdP push relinked the identity through its tombstone, silently re-adding the member. removeUserFromOrganization now refuses self-removal for a directory-managed member (same transaction, SCIM_MANAGED_MEMBERSHIP) with a message pointing to the identity provider. The error shows in the existing Leave dialog
• Admin removal of others, SCIM deprovisioning, and the admin routes are unaffected (only the self path passes the actor as the target). Covers the Members UI, Chat's organization/members remove op, and v2 DELETE /organizations/{id}/members/{userId}, which share the use case
• Org rename: the header kept rendering the server-provided name until the refresh landed, so the old name flashed back after a successful rename. It now shows the saved name until the server prop catches up (scoped to the name it replaced, so a later external rename still shows)

Type of Change

• Bug fix

Testing

• managed-membership.integration.ts (real Postgres): managed self-leave refused and membership kept; admin removing the same managed member succeeds; unmanaged self-leave succeeds. 12/12; red with the check removed, and red with the self-only condition dropped
• member-manager, member-role, member-removal, organizations use-cases, managed-membership unit, workspace permissions route, billing lock-order/external-removal/reconciliation tests (55 passing)
• bun run lint, check:boundaries, check:source-conventions, check:comment-hygiene, check:client-boundary, pre-push type-check

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 3, 2026 4:42am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues remain.

Summary

Blocks directory-managed members from leaving while preserving administrator removal and keeping a saved organization name visible during refresh.

• Directory-managed members stay in the organization when they try to leave.
• The organization header keeps a saved rename visible until the server catches up.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Transfer ownership] --> B[Previous owner becomes admin]
  B --> C{Also leave?}
  C -->|No| D[Return transfer success]
  C -->|Yes| E[Check self-leave policy]
  E -->|Directory-managed| F[Keep membership and return warning]
  E -->|Allowed| G[Remove membership]
  F --> H[Page shows warning]
  G --> I[Page redirects]

Loading

_{Reviews (3) · Last reviewed commit: "fix(organizations): transfer ownership f..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

Design change in 4d78535: for a directory-managed owner, the leave is refused, the transfer is not.

c2d5e0b refused transfer-and-leave up front. The settings UI always sends alsoLeave: true, so that blocked managed owners from transferring ownership at all, which they could do before. That check has been removed. The transfer now always proceeds as it did before. The leave that follows it now passes actorUserId, so assertSelfLeaveNotScimManaged refuses it inside the removal transaction.

• Resulting state: consistent, not half-applied. The new member is owner and the previous owner stays as admin, the same as a plain transfer.
• Route: returns its existing 207 { transferred: true, left: false, warning }, where warning is the identity-provider message. The policy refusal is logged at info, not error. removeUserFromOrganization now returns refusalCode for policy refusals so the route can tell the two apart.
• UI: the transfer dialog no longer closes silently when the leave was refused. It shows a warning toast: "Ownership transferred. ".
• Tests: managed-membership.integration.ts checks that a managed owner's transfer-and-leave transfers ownership and keeps them as admin, and that a plain transfer still works.

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}