Prevent the sole owner from leaving a group
- Dominant language
- Python
- Stars
- 3.2k
- Forks
- 459
- Avg merge
- 27d 1h
- Merged PRs (30d)
- 1
Description
See also: https://github.com/hypothesis/h/issues/9147
From the [Engineering Requirements Document](https://docs.google.com/document/d/1Okfzw0D3nOsmJLA4hqLPoPhjyAWQCyXSCuqId1phELQ): If you are the sole owner of a group, you cannot leave that group without designating a new owner–unless it has no annotations other than your own.
From the [Product Requirements Document](https://docs.google.com/document/d/1ORrxBBv9rQV6ZXzgBTYbTosPXly3EOFx7kyd69yChrs): if the group has other Members and especially other Users’ annotations I will need to elevate a group Member or Moderator to take the Owner role over as I leave.
Note that preventing the sole owner from leaving a group cannot remove the possibility of owner-less groups existing: there are already owner-less groups in the production DB, and more can be created if the sole owner of a group deletes their account or if a Hypothesis admin deletes their account. So h code and UI design will have to continue to account for the possibility of groups with no owners.
I think we may want to allow the sole owner to leave a group if:
1. The group doesn't contain any annotations from other users, even if the group does have other members.
2. The group doesn't have any other members, even if the group does contain annotations from other users.
In all other cases if the last owner tries to leave a group they should see an error message telling them that they need to change another user's role to owner first. The error message should contain a link to the `https://hypothes.is/groups/{pubid}/edit/members` page where the user can make this role change.
Note that there are multiple ways that a user can attempt to leave a group, and we need to cover all of them:
1. A user can call the remove-member-from-group API directly: https://h.readthedocs.io/en/latest/api-reference/v1/#tag/groups/paths/~1groups~1{id}~1members~1{user}/delete
2. A user can use the _Leave group_ button in the client's groups menu:

3. A user can use the _Leave this group_ button in the sidebar on the group's page (`https://hypothes.is/groups/{pubid}/flag-test`):

4. (Not yet implemented:) a user can delete themselves from the group using the _Members_ table on the group's `https://hypothes.is/groups/{pubid}/edit/members` page. This is not yet implemented: at the time of writing the user can't remove themselves from the group on this page. But there's a plan to enable it at some point.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the remove-member-from-group API and the two client leave-group entry points described in the issue; the Members page is a planned additional path. Ensure the sole owner can leave only under the stated empty-membership or annotation conditions, and otherwise receives an error linking to the group members page. Cover each implemented path with tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authorization, frontend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100