h
h copied to clipboard
Prevent the sole owner from leaving a group
See also: https://github.com/hypothesis/h/issues/9147
From the Engineering Requirements Document: If you are the sole owner of a group, you cannot leave that group without designating a new owner–unless it has no annotations other than your own.
From the Product Requirements Document: if the group has other Members and especially other Users’ annotations I will need to elevate a group Member or Moderator to take the Owner role over as I leave.
Note that preventing the sole owner from leaving a group cannot remove the possibility of owner-less groups existing: there are already owner-less groups in the production DB, and more can be created if the sole owner of a group deletes their account or if a Hypothesis admin deletes their account. So h code and UI design will have to continue to account for the possibility of groups with no owners.
I think we may want to allow the sole owner to leave a group if:
- The group doesn't contain any annotations from other users, even if the group does have other members.
- The group doesn't have any other members, even if the group does contain annotations from other users.
In all other cases if the last owner tries to leave a group they should see an error message telling them that they need to change another user's role to owner first. The error message should contain a link to the https://hypothes.is/groups/{pubid}/edit/members page where the user can make this role change.
Note that there are multiple ways that a user can attempt to leave a group, and we need to cover all of them:
-
A user can call the remove-member-from-group API directly: https://h.readthedocs.io/en/latest/api-reference/v1/#tag/groups/paths/~1groups~1{id}~1members~1{user}/delete
-
A user can use the Leave group button in the client's groups menu:
-
A user can use the Leave this group button in the sidebar on the group's page (
https://hypothes.is/groups/{pubid}/flag-test): -
(Not yet implemented:) a user can delete themselves from the group using the Members table on the group's
https://hypothes.is/groups/{pubid}/edit/memberspage. This is not yet implemented: at the time of writing the user can't remove themselves from the group on this page. But there's a plan to enable it at some point.