Filter unconfirmed members when transferring team ownership

Prevent unconfirmed (pending invite) members from being promoted to
owner or set as the team's primary user during membership/account
deletion by adding a Query::equal('confirm', [true]) filter to the
relevant findOne queries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Damodar Lohani
2026-04-05 02:02:09 +00:00
co-authored by Claude Opus 4.6
parent d831b93934
commit 16ed60a5c3
3 changed files with 3 additions and 0 deletions
+1
View File
@@ -667,6 +667,7 @@ Http::delete('/v1/account')
$nextMember = $dbForProject->findOne('memberships', [
Query::equal('teamInternalId', [$team->getSequence()]),
Query::notEqual('userInternalId', $user->getSequence()),
Query::equal('confirm', [true]),
]);
if (!$nextMember->isEmpty()) {
@@ -126,6 +126,7 @@ class Delete extends Action
if ($team->getAttribute('userInternalId') === $membership->getAttribute('userInternalId')) {
$membership = $dbForProject->findOne('memberships', [
Query::equal('teamInternalId', [$team->getSequence()]),
Query::equal('confirm', [true]),
]);
if (!$membership->isEmpty()) {
@@ -856,6 +856,7 @@ class Deletes extends Action
if ($team->getAttribute('userInternalId') === $userInternalId) {
$nextMembership = $dbForProject->findOne('memberships', [
Query::equal('teamInternalId', [$team->getSequence()]),
Query::equal('confirm', [true]),
]);
if ($nextMembership !== false && !$nextMembership->isEmpty()) {