fix(workspaces): explain why org admins can't be removed from a workspace

Organization admins hold workspace admin through their org role, not a
permissions row, so removal had nothing to revoke. It failed with "User
not found in workspace" for someone listed as an Admin on the same
screen, and when they also held an explicit row it deleted a grant the
derived one immediately replaced — which could drop their org membership
and seat, since the seat reconciliation counts rows only.

Author: Vikhyath Mondreti

apps/sim/app/api/workspaces/members/[id]/route.ts

@@ -13,7 +13,10 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { revokeWorkspaceCredentialMembershipsTx } from '@/lib/credentials/access'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { removeWorkspaceSkillMembershipsTx } from '@/lib/skills/access'
-import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
+import {
+  hasWorkspaceAdminAccess,
+  isOrganizationAdminOrOwner,
+} from '@/lib/workspaces/permissions/utils'
 import {
   reassignWorkflowOwnershipForWorkspaceMemberRemovalTx,
   transferWorkspaceOwnershipToBilledAccountForMemberRemovalTx,
@@ -51,13 +54,52 @@ export const DELETE = withRouteHandler(
         return NextResponse.json({ error: 'Workspace not found' }, { status: 404 })
       }
 
+      const organizationId = workspaceRow[0].organizationId
+
+      /**
+       * Authority is settled before anything is answered about the target, so
+       * the standing-specific replies below only ever describe someone the
+       * caller can already see in the members list.
+       */
+      const hasAdminAccess = await hasWorkspaceAdminAccess(session.user.id, workspaceId)
+      const isSelf = userId === session.user.id
+
+      if (!hasAdminAccess && !isSelf) {
+        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
+      }
+
       if (workspaceRow[0].billedAccountUserId === userId) {
         return NextResponse.json(
           { error: 'Cannot remove the workspace billing account. Please reassign billing first.' },
           { status: 400 }
         )
       }
 
+      /**
+       * Organization admins hold workspace admin across the whole organization
+       * through `member.role`, not through a `permissions` row, so removal has
+       * nothing to revoke. Left to fall through, the two shapes failed in two
+       * different ways: with no row it answered "user not found in workspace"
+       * about someone listed as an Admin on the very screen the caller clicked
+       * from, and with a row it deleted a grant the derived one immediately
+       * replaced — while the seat reconciliation below counts rows only, so
+       * that no-op could still drop the admin's organization membership.
+       *
+       * Mirrored by `workspaceMemberRemovalLockReason` on the client, and by the
+       * same guard on `PATCH /api/workspaces/[id]/permissions`, which refuses to
+       * re-role an organization admin for the same reason.
+       */
+      if (organizationId && (await isOrganizationAdminOrOwner(userId, organizationId))) {
+        return NextResponse.json(
+          {
+            error: isSelf
+              ? 'Organization admins are automatically workspace admins. Change your organization role to leave this workspace.'
+              : 'Organization admins are automatically workspace admins. Change their organization role to remove them from this workspace.',
+          },
+          { status: 400 }
+        )
+      }
+
       // Check if the user to be removed actually has permissions for this workspace
       const userPermission = await db
         .select()
@@ -78,14 +120,6 @@ export const DELETE = withRouteHandler(
         return NextResponse.json({ error: 'User not found in workspace' }, { status: 404 })
       }
 
-      // Check if current user has admin access to this workspace
-      const hasAdminAccess = await hasWorkspaceAdminAccess(session.user.id, workspaceId)
-      const isSelf = userId === session.user.id
-
-      if (!hasAdminAccess && !isSelf) {
-        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
-      }
-
       // Removing the workspace owner is allowed for any admin: ownership transfers
       // to the billing account in the transaction below. The billing account itself
       // stays protected by the guard above (and personal workspaces, where owner ==
@@ -113,8 +147,6 @@ export const DELETE = withRouteHandler(
         }
       }
 
-      const organizationId = workspaceRow[0].organizationId
-
       const { ownershipTransferred, workflowOwnershipReassignment } = await db.transaction(
         async (tx) => {
           const didTransferOwnership =

apps/sim/app/workspace/[workspaceId]/settings/components/teammates/teammates.tsx

@@ -9,6 +9,7 @@ import { useParams, useRouter } from 'next/navigation'
 import {
   RoleLockTooltip,
   type WorkspaceRoleSource,
+  workspaceMemberRemovalLockReason,
   workspaceRoleLockReason,
 } from '@/components/permissions'
 import { canMutateWorkspaceSettingsSection } from '@/components/settings/navigation'
@@ -56,6 +57,7 @@ interface Teammate {
   invitationId?: string
   token?: string
   roleSource?: WorkspaceRoleSource
+  isOrgAdmin?: boolean
   isBilledAccount?: boolean
 }
 
@@ -139,6 +141,7 @@ export function Teammates() {
       isPending: false,
       userId: member.userId,
       roleSource: member.roleSource,
+      isOrgAdmin: member.isOrgAdmin,
       isBilledAccount: member.isBilledAccount,
     }))
 
@@ -206,20 +209,33 @@ export function Teammates() {
             searchTerm.trim() ? `No teammates found matching “${searchTerm}”` : 'No teammates yet'
           }
         >
-          {filteredTeammates.map((teammate) => (
-            <MemberRow
-              key={teammate.key}
-              name={teammate.name}
-              email={teammate.email}
-              image={teammate.image}
-              status={teammate.status}
-              roleControl={(() => {
-                const lockReason = teammate.isPending
-                  ? null
-                  : workspaceRoleLockReason(teammate.roleSource, {
-                      isBilledAccount: teammate.isBilledAccount,
-                    })
-                return (
+          {filteredTeammates.map((teammate) => {
+            const lockReason = teammate.isPending
+              ? null
+              : workspaceRoleLockReason(teammate.roleSource, {
+                  isBilledAccount: teammate.isBilledAccount,
+                })
+            /**
+             * Removal is refused for a different set than the role control locks,
+             * so it carries its own reason — and stays visible-but-disabled rather
+             * than hidden, so the row explains the derived access instead of
+             * leaving an Admin who cannot be acted on.
+             */
+            const removalLockReason = teammate.isPending
+              ? null
+              : workspaceMemberRemovalLockReason({
+                  isOrgAdmin: teammate.isOrgAdmin,
+                  isBilledAccount: teammate.isBilledAccount,
+                })
+
+            return (
+              <MemberRow
+                key={teammate.key}
+                name={teammate.name}
+                email={teammate.email}
+                image={teammate.image}
+                status={teammate.status}
+                roleControl={
                   <RoleLockTooltip reason={lockReason}>
                     <ChipDropdown
                       value={teammate.role}
@@ -234,83 +250,85 @@ export function Teammates() {
                       }
                     />
                   </RoleLockTooltip>
-                )
-              })()}
-              menu={
-                <RowActionsMenu
-                  label='Teammate actions'
-                  actions={[
-                    {
-                      label: 'Copy email',
-                      onSelect: () => copyToClipboard(teammate.email),
-                    },
-                    ...(canManage && teammate.isPending
-                      ? [
-                          {
-                            label: 'Resend invite',
-                            onSelect: () => {
-                              if (teammate.invitationId) {
-                                resendInvitation.mutate({
-                                  invitationId: teammate.invitationId,
-                                  workspaceId,
-                                })
-                              }
+                }
+                menu={
+                  <RowActionsMenu
+                    label='Teammate actions'
+                    actions={[
+                      {
+                        label: 'Copy email',
+                        onSelect: () => copyToClipboard(teammate.email),
+                      },
+                      ...(canManage && teammate.isPending
+                        ? [
+                            {
+                              label: 'Resend invite',
+                              onSelect: () => {
+                                if (teammate.invitationId) {
+                                  resendInvitation.mutate({
+                                    invitationId: teammate.invitationId,
+                                    workspaceId,
+                                  })
+                                }
+                              },
                             },
-                          },
-                          {
-                            label: 'Copy invite link',
-                            onSelect: () => {
-                              if (teammate.invitationId && teammate.token) {
-                                copyToClipboard(
-                                  buildInviteLink(teammate.invitationId, teammate.token)
-                                )
-                              }
+                            {
+                              label: 'Copy invite link',
+                              onSelect: () => {
+                                if (teammate.invitationId && teammate.token) {
+                                  copyToClipboard(
+                                    buildInviteLink(teammate.invitationId, teammate.token)
+                                  )
+                                }
+                              },
                             },
-                          },
-                          {
-                            label: 'Revoke invite',
-                            destructive: true,
-                            onSelect: () => {
-                              if (teammate.invitationId) {
-                                cancelInvitation.mutate({
-                                  invitationId: teammate.invitationId,
-                                  workspaceId,
-                                })
-                              }
+                            {
+                              label: 'Revoke invite',
+                              destructive: true,
+                              onSelect: () => {
+                                if (teammate.invitationId) {
+                                  cancelInvitation.mutate({
+                                    invitationId: teammate.invitationId,
+                                    workspaceId,
+                                  })
+                                }
+                              },
                             },
-                          },
-                        ]
-                      : []),
-                    ...(canManage && !teammate.isPending && teammate.userId !== viewer?.userId
-                      ? [
-                          {
-                            label: 'Remove',
-                            destructive: true,
-                            onSelect: () => {
-                              if (teammate.userId) {
-                                removeMember.mutate(
-                                  { userId: teammate.userId, workspaceId },
-                                  {
-                                    onError: (error) => {
-                                      toast.error("Couldn't remove teammate", {
-                                        description: getErrorMessage(
-                                          error,
-                                          'Please try again in a moment.'
-                                        ),
-                                      })
-                                    },
-                                  }
-                                )
-                              }
+                          ]
+                        : []),
+                      ...(canManage && !teammate.isPending && teammate.userId !== viewer?.userId
+                        ? [
+                            {
+                              label: 'Remove',
+                              destructive: true,
+                              disabled: removalLockReason !== null,
+                              tooltip: removalLockReason ?? undefined,
+                              onSelect: () => {
+                                if (teammate.userId) {
+                                  removeMember.mutate(
+                                    { userId: teammate.userId, workspaceId },
+                                    {
+                                      onError: (error) => {
+                                        toast.error("Couldn't remove teammate", {
+                                          description: getErrorMessage(
+                                            error,
+                                            'Please try again in a moment.'
+                                          ),
+                                        })
+                                      },
+                                    }
+                                  )
+                                }
+                              },
                             },
-                          },
-                        ]
-                      : []),
-                  ]}
-                />
-              }
-            />
-          ))}
+                          ]
+                        : []),
+                    ]}
+                  />
+                }
+              />
+            )
+          })}
         </MemberSection>
       </SettingsPanel>
 

apps/sim/components/permissions/index.ts

@@ -19,5 +19,6 @@ export {
   RoleLockTooltip,
   skillEditorLockReason,
   type WorkspaceRoleSource,
+  workspaceMemberRemovalLockReason,
   workspaceRoleLockReason,
 } from './role-lock'

apps/sim/components/permissions/role-lock.tsx

@@ -24,6 +24,32 @@ export function workspaceRoleLockReason(
   return null
 }
 
+/**
+ * Explanation shown when a workspace member cannot be removed from the
+ * workspace. Returns null when removal is allowed.
+ *
+ * Mirrors the server guards on `DELETE /api/workspaces/members/[id]`, so every
+ * reason here must have a guard there and vice versa.
+ *
+ * Deliberately keyed on facts rather than on `roleSource` like
+ * {@link workspaceRoleLockReason}: the two disagree about the workspace owner,
+ * whose role is fixed but who can still be removed (ownership transfers to the
+ * billing account) — and `roleSource` ranks `owner` above `org-admin`, so it
+ * cannot answer for someone who is both.
+ */
+export function workspaceMemberRemovalLockReason(options?: {
+  isOrgAdmin?: boolean
+  isBilledAccount?: boolean
+}): string | null {
+  if (options?.isOrgAdmin) {
+    return 'Organization admins are automatically workspace admins. Change their organization role to remove them.'
+  }
+  if (options?.isBilledAccount) {
+    return 'Reassign billing before removing the workspace billing account'
+  }
+  return null
+}
+
 /**
  * Explanation shown when a credential member's role is fixed because they are a
  * workspace admin. Returns null for editable (`explicit`) roles.

apps/sim/lib/api/contracts/workspaces.ts

@@ -94,6 +94,7 @@ export const workspaceUserSchema = z.object({
   isExternal: z.boolean(),
   joinedAt: z.string(),
   roleSource: z.enum(['owner', 'explicit', 'org-admin']),
+  isOrgAdmin: z.boolean(),
   isBilledAccount: z.boolean(),
 })