From ff3e8aa29e1d260a079b2564344d1119a41a1469 Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Thu, 8 Dec 2022 16:29:19 +0800
Subject: [PATCH] Add delete permission to group and membership tables

---
 packages/api/src/services/groups.ts              | 16 +++++++++++-----
 .../0103.do.add_delete_permission_to_group.sql   | 11 +++++++++++
 .../0103.undo.add_delete_permission_to_group.sql | 11 +++++++++++
 3 files changed, 33 insertions(+), 5 deletions(-)
 create mode 100755 packages/db/migrations/0103.do.add_delete_permission_to_group.sql
 create mode 100755 packages/db/migrations/0103.undo.add_delete_permission_to_group.sql

diff --git a/packages/api/src/services/groups.ts b/packages/api/src/services/groups.ts
index 65fa13d5a..296b18954 100644
--- a/packages/api/src/services/groups.ts
+++ b/packages/api/src/services/groups.ts
@@ -172,19 +172,25 @@ export const leaveGroup = async (
       throw new Error('User not in group')
     }
 
+    const membershipId = membership.id
     await t.getRepository(GroupMembership).remove(membership)
 
+    if (group.members.length === 1) {
+      // delete the group if there are no more members
+      await t.getRepository(Group).remove(group)
+
+      return true
+    }
+
     if (membership.isAdmin) {
-      // If the user is the admin, we need to promote another user to admin
+      // If the user is the only admin, we need to promote another user to admin
       const hasAdmin = group.members.some(
-        (m) => m.isAdmin && m.user.id !== user.id
+        (m) => m.isAdmin && m.id !== membershipId
       )
       if (!hasAdmin) {
         const newAdmin = group.members.find((m) => !m.isAdmin)
         if (!newAdmin) {
-          // delete the group if there are no more members
-          await t.getRepository(Group).delete({ id: group.id })
-          return true
+          throw new Error('No user found')
         }
 
         newAdmin.isAdmin = true
diff --git a/packages/db/migrations/0103.do.add_delete_permission_to_group.sql b/packages/db/migrations/0103.do.add_delete_permission_to_group.sql
new file mode 100755
index 000000000..6bfa66541
--- /dev/null
+++ b/packages/db/migrations/0103.do.add_delete_permission_to_group.sql
@@ -0,0 +1,11 @@
+-- Type: DO
+-- Name: add_delete_permission_to_group
+-- Description: Add delete permission to group and membership table
+
+BEGIN;
+
+GRANT DELETE ON omnivore."group" TO omnivore_user;
+
+GRANT DELETE ON omnivore.group_membership TO omnivore_user;
+
+COMMIT;
diff --git a/packages/db/migrations/0103.undo.add_delete_permission_to_group.sql b/packages/db/migrations/0103.undo.add_delete_permission_to_group.sql
new file mode 100755
index 000000000..4c8a8ff1a
--- /dev/null
+++ b/packages/db/migrations/0103.undo.add_delete_permission_to_group.sql
@@ -0,0 +1,11 @@
+-- Type: UNDO
+-- Name: add_delete_permission_to_group
+-- Description: Add delete permission to group and membership table
+
+BEGIN;
+
+REVOKE DELETE ON omnivore.group_membership FROM omnivore_user;
+
+REVOKE DELETE ON omnivore."group" FROM omnivore_user;
+
+COMMIT;