fix(workspaces): explain why org admins can't be removed from a workspace (#6838)

* fix(workspaces): explain why org admins can't be removed from a workspace

Organization admins hold workspace admin through their org role, not a
permissions row, so removal had nothing to revoke. It failed with "User
not found in workspace" for someone listed as an Admin on the same
screen, and when they also held an explicit row it deleted a grant the
derived one immediately replaced — which could drop their org membership
and seat, since the seat reconciliation counts rows only.

* fix(workspaces): stop offering leave to org admins and surface refusals

Sidebar Leave was still offered to non-owner organization admins, whose
access is derived and cannot be given up, and the confirm modal swallowed
the refusal — so it sat open with no reason shown. The workspaces list now
reports whether the viewer's admin access came from their org role, which
`permissions: 'admin'` alone could not distinguish from an explicit grant.

Also folds a disabled row action's tooltip into its accessible name, since
Radix skips disabled items in a menu's roving focus.

Author: icecrasher321

apps/sim/app/api/workspaces/members/[id]/route.ts

@@ -13,7 +13,10 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { revokeWorkspaceCredentialMembershipsTx } from '@/lib/credentials/access'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { removeWorkspaceSkillMembershipsTx } from '@/lib/skills/access'
-import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
+import {
+  hasWorkspaceAdminAccess,
+  isOrganizationAdminOrOwner,
+} from '@/lib/workspaces/permissions/utils'
 import {
   reassignWorkflowOwnershipForWorkspaceMemberRemovalTx,
   transferWorkspaceOwnershipToBilledAccountForMemberRemovalTx,
@@ -51,13 +54,52 @@ export const DELETE = withRouteHandler(
         return NextResponse.json({ error: 'Workspace not found' }, { status: 404 })
       }
 
+      const organizationId = workspaceRow[0].organizationId
+
+      /**
+       * Authority is settled before anything is answered about the target, so
+       * the standing-specific replies below only ever describe someone the
+       * caller can already see in the members list.
+       */
+      const hasAdminAccess = await hasWorkspaceAdminAccess(session.user.id, workspaceId)
+      const isSelf = userId === session.user.id
+
+      if (!hasAdminAccess && !isSelf) {
+        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
+      }
+
       if (workspaceRow[0].billedAccountUserId === userId) {
         return NextResponse.json(
           { error: 'Cannot remove the workspace billing account. Please reassign billing first.' },
           { status: 400 }
         )
       }
 
+      /**
+       * Organization admins hold workspace admin across the whole organization
+       * through `member.role`, not through a `permissions` row, so removal has
+       * nothing to revoke. Left to fall through, the two shapes failed in two
+       * different ways: with no row it answered "user not found in workspace"
+       * about someone listed as an Admin on the very screen the caller clicked
+       * from, and with a row it deleted a grant the derived one immediately
+       * replaced — while the seat reconciliation below counts rows only, so
+       * that no-op could still drop the admin's organization membership.
+       *
+       * Mirrored by `workspaceMemberRemovalLockReason` on the client, and by the
+       * same guard on `PATCH /api/workspaces/[id]/permissions`, which refuses to
+       * re-role an organization admin for the same reason.
+       */
+      if (organizationId && (await isOrganizationAdminOrOwner(userId, organizationId))) {
+        return NextResponse.json(
+          {
+            error: isSelf
+              ? 'Organization admins are automatically workspace admins. Change your organization role to leave this workspace.'
+              : 'Organization admins are automatically workspace admins. Change their organization role to remove them from this workspace.',
+          },
+          { status: 400 }
+        )
+      }
+
       // Check if the user to be removed actually has permissions for this workspace
       const userPermission = await db
         .select()
@@ -78,14 +120,6 @@ export const DELETE = withRouteHandler(
         return NextResponse.json({ error: 'User not found in workspace' }, { status: 404 })
       }
 
-      // Check if current user has admin access to this workspace
-      const hasAdminAccess = await hasWorkspaceAdminAccess(session.user.id, workspaceId)
-      const isSelf = userId === session.user.id
-
-      if (!hasAdminAccess && !isSelf) {
-        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })
-      }
-
       // Removing the workspace owner is allowed for any admin: ownership transfers
       // to the billing account in the transaction below. The billing account itself
       // stays protected by the guard above (and personal workspaces, where owner ==
@@ -113,8 +147,6 @@ export const DELETE = withRouteHandler(
         }
       }
 
-      const organizationId = workspaceRow[0].organizationId
-
       const { ownershipTransferred, workflowOwnershipReassignment } = await db.transaction(
         async (tx) => {
           const didTransferOwnership =

apps/sim/app/workspace/[workspaceId]/settings/components/row-actions-menu/row-actions-menu.test.tsx

@@ -0,0 +1,115 @@
+/**
+ * @vitest-environment jsdom
+ *
+ * A row action the server would refuse stays visible and greyed rather than
+ * disappearing, so the row can say why. That only works if three things hold at
+ * once: the item is actually disabled (Radix greys it), the reason reaches
+ * pointer users through the platform tooltip — which needs the wrapping span,
+ * since a disabled item is `pointer-events-none` and never sees the hover — and
+ * the reason reaches assistive tech through the accessible name, since Radix
+ * skips disabled items in a menu's roving focus.
+ */
+import { act, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it } from 'vitest'
+import { RowActionsMenu } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu/row-actions-menu'
+
+const LOCK_REASON = 'Organization admins are automatically workspace admins.'
+
+let root: Root | null = null
+let container: HTMLDivElement | null = null
+
+function mount(ui: ReactNode) {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  act(() => root?.render(ui))
+}
+
+/** Opens the `...` menu the way a pointer does — Radix opens on `pointerdown`. */
+function openMenu() {
+  const trigger = container?.querySelector('button')
+  if (!trigger) throw new Error('Menu trigger did not render')
+  act(() => {
+    trigger.dispatchEvent(new MouseEvent('pointerdown', { bubbles: true, button: 0 }))
+  })
+}
+
+function item(): HTMLElement {
+  const node = document.querySelector('[role="menuitem"]')
+  if (!node) throw new Error('No menu item rendered')
+  return node as HTMLElement
+}
+
+afterEach(() => {
+  if (root) act(() => root?.unmount())
+  container?.remove()
+  root = null
+  container = null
+})
+
+describe('a disabled row action explains itself', () => {
+  function mountLockedRemove() {
+    mount(
+      <RowActionsMenu
+        label='Teammate actions'
+        actions={[
+          {
+            label: 'Remove',
+            destructive: true,
+            disabled: true,
+            tooltip: LOCK_REASON,
+            onSelect: () => {},
+          },
+        ]}
+      />
+    )
+    openMenu()
+  }
+
+  it('greys the item out instead of hiding it', () => {
+    mountLockedRemove()
+
+    const remove = item()
+    expect(remove.textContent).toBe('Remove')
+    expect(remove.getAttribute('data-disabled')).not.toBeNull()
+    expect(remove.className).toContain('data-[disabled]:opacity-50')
+  })
+
+  it('shows the reason in the platform tooltip on hover', () => {
+    mountLockedRemove()
+
+    expect(document.querySelector('[role="tooltip"]')).toBeNull()
+
+    /* The wrapping span, not the item — a disabled item is `pointer-events-none`. */
+    const hoverTarget = item().parentElement
+    if (!hoverTarget) throw new Error('Tooltip trigger wrapper did not render')
+    act(() => {
+      hoverTarget.dispatchEvent(
+        new MouseEvent('pointerover', { bubbles: true, clientX: 120, clientY: 120 })
+      )
+    })
+
+    expect(document.querySelector('[role="tooltip"]')?.textContent).toBe(LOCK_REASON)
+  })
+
+  it('folds the reason into the accessible name for assistive tech', () => {
+    mountLockedRemove()
+
+    expect(item().getAttribute('aria-label')).toBe(`Remove — ${LOCK_REASON}`)
+  })
+
+  it('leaves an enabled action unlabelled and untooltipped', () => {
+    mount(
+      <RowActionsMenu
+        label='Teammate actions'
+        actions={[{ label: 'Copy email', onSelect: () => {} }]}
+      />
+    )
+    openMenu()
+
+    expect(item().getAttribute('aria-label')).toBeNull()
+    expect(item().getAttribute('data-disabled')).toBeNull()
+  })
+})

apps/sim/app/workspace/[workspaceId]/settings/components/row-actions-menu/row-actions-menu.tsx

@@ -34,6 +34,11 @@ interface RowActionsMenuProps {
  * An action with a `tooltip` gets its item wrapped in a plain span tooltip
  * trigger (the settings-header chip pattern) — a disabled item is
  * `pointer-events-none`, so the wrapper is what keeps hover working.
+ *
+ * A disabled item's tooltip also folds into its accessible name, because Radix
+ * skips disabled items in a menu's roving focus: without this the explanation
+ * would reach pointer users only, and assistive tech would announce a dead
+ * "Remove" with no reason attached.
  */
 export function RowActionsMenu({ label, actions, triggerClassName }: RowActionsMenuProps) {
   return (
@@ -50,6 +55,11 @@ export function RowActionsMenu({ label, actions, triggerClassName }: RowActionsM
               key={action.label}
               onSelect={action.onSelect}
               disabled={action.disabled}
+              aria-label={
+                action.disabled && action.tooltip
+                  ? `${action.label} — ${action.tooltip}`
+                  : undefined
+              }
               className={action.destructive ? 'text-[var(--text-error)]' : undefined}
             >
               {action.label}