fix: check edited member, not editor, for org owner permission guard (#1400 )

2026-07-31 21:26:40 +00:00 · 2026-05-07 14:48:52 +02:00
1 changed files with 13 additions and 1 deletions
@@ -760,7 +760,19 @@ pub async fn edit_team_member(
                    None
                };

-            if organization_team_member
+            let edited_member_organization_team_member =
+                if let Some(organization) = &organization {
+                    DBTeamMember::get_from_user_id(
+                        organization.team_id,
+                        user_id,
+                        &**pool,
+                    )
+                    .await?
+                } else {
+                    None
+                };
+
+            if edited_member_organization_team_member
                .as_ref()
                .is_some_and(|x| x.is_owner)
                && edit_member