Removing an org member leaves their team membership and grants #196

closed cmc opened this on 2026-09-07 21:59 UTC · bug orgs security

Discussion

cmc 2026-09-07 21:59 UTC

Observed on gitbay.org with the #185 fixtures. org members remove ttorg tt-bob succeeded; bob, whose write on ttorg/widget came through team core, then pushed a branch to the repository, approved ttorg/widget!2, and mr show reports the approval as counting. org team show ttorg core still lists him. Re-adding him to the org needed no org team add.

RemoveOrgMember (internal/store/orgs.go:147) deletes the org_members row and nothing in team_members. org team add refuses non-members, so the invariant is assumed on the way in and not kept on the way out.

Fix: delete the account's team_members rows for the org's teams in the same transaction. Add an e2e test that removes a member and asserts the push is refused.

Ref #185

closed by commit 1285c70990 by cmc: store: removing an org member drops their team memberships

2026-09-08 02:35 UTC