chore: prevent removing members from the default organization (#14094)

* chore: prevent removing members from the default organization

Until multi-organizations is released outside an experiment, the
experiment should be backwards compatible.

coderd/members.go

@@ -106,6 +106,19 @@ func (api *API) deleteOrganizationMember(rw http.ResponseWriter, r *http.Request
 	aReq.Old = member.OrganizationMember.Auditable(member.Username)
 	defer commitAudit()
 
+	if organization.IsDefault {
+		// Multi-organizations is currently an experiment, which means it is feasible
+		// for a deployment to enable, then disable this. To maintain backwards
+		// compatibility, this safety is necessary.
+		// TODO: Remove this check when multi-organizations is fully supported.
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message:     "Removing members from the default organization is not supported.",
+			Detail:      "Multi-organizations is currently an experiment, and until it is fully supported, the default org should be protected.",
+			Validations: nil,
+		})
+		return
+	}
+
 	if member.UserID == apiKey.UserID {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{Message: "cannot remove self from an organization"})
 		return

coderd/members_test.go

@@ -30,6 +30,25 @@ func TestAddMember(t *testing.T) {
 	})
 }
 
+func TestDeleteMember(t *testing.T) {
+	t.Parallel()
+
+	t.Run("NotAllowed", func(t *testing.T) {
+		t.Parallel()
+		owner := coderdtest.New(t, nil)
+		first := coderdtest.CreateFirstUser(t, owner)
+		_, user := coderdtest.CreateAnotherUser(t, owner, first.OrganizationID)
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		// Deleting members from the default org is not allowed.
+		// If this behavior changes, and we allow deleting members from the default org,
+		// this test should be updated to check there is no error.
+		// nolint:gocritic // must be an owner to see the user
+		err := owner.DeleteOrganizationMember(ctx, first.OrganizationID, user.Username)
+		require.ErrorContains(t, err, "Multi-organizations is currently an experiment")
+	})
+}
+
 func TestListMembers(t *testing.T) {
 	t.Parallel()
 
@@ -50,38 +69,6 @@ func TestListMembers(t *testing.T) {
 	})
 }
 
-func TestRemoveMember(t *testing.T) {
-	t.Parallel()
-
-	t.Run("OK", func(t *testing.T) {
-		t.Parallel()
-		owner := coderdtest.New(t, nil)
-		first := coderdtest.CreateFirstUser(t, owner)
-		orgAdminClient, orgAdmin := coderdtest.CreateAnotherUser(t, owner, first.OrganizationID, rbac.ScopedRoleOrgAdmin(first.OrganizationID))
-		_, user := coderdtest.CreateAnotherUser(t, owner, first.OrganizationID)
-
-		ctx := testutil.Context(t, testutil.WaitMedium)
-		// Verify the org of 3 members
-		members, err := orgAdminClient.OrganizationMembers(ctx, first.OrganizationID)
-		require.NoError(t, err)
-		require.Len(t, members, 3)
-		require.ElementsMatch(t,
-			[]uuid.UUID{first.UserID, user.ID, orgAdmin.ID},
-			db2sdk.List(members, onlyIDs))
-
-		// Delete a member
-		err = orgAdminClient.DeleteOrganizationMember(ctx, first.OrganizationID, user.Username)
-		require.NoError(t, err)
-
-		members, err = orgAdminClient.OrganizationMembers(ctx, first.OrganizationID)
-		require.NoError(t, err)
-		require.Len(t, members, 2)
-		require.ElementsMatch(t,
-			[]uuid.UUID{first.UserID, orgAdmin.ID},
-			db2sdk.List(members, onlyIDs))
-	})
-}
-
 func onlyIDs(u codersdk.OrganizationMemberWithUserData) uuid.UUID {
 	return u.UserID
 }