diff --git a/atst/routes/portfolios/admin.py b/atst/routes/portfolios/admin.py index 460451d8..bc51405d 100644 --- a/atst/routes/portfolios/admin.py +++ b/atst/routes/portfolios/admin.py @@ -177,6 +177,12 @@ def remove_member(portfolio_id, user_id): g.current_user, "you cant remove yourself from the portfolio" ) + portfolio = Portfolios.get(user=g.current_user, portfolio_id=portfolio_id) + if user_id == str(portfolio.owner.id): + raise UnauthorizedError( + g.current_user, "you can't delete the portfolios PPoC from the portfolio" + ) + portfolio_role = PortfolioRoles.get(portfolio_id=portfolio_id, user_id=user_id) # TODO: should this cascade and disable any application and environment # roles they might have? diff --git a/tests/routes/portfolios/test_admin.py b/tests/routes/portfolios/test_admin.py index a1ec92a3..0085a9b5 100644 --- a/tests/routes/portfolios/test_admin.py +++ b/tests/routes/portfolios/test_admin.py @@ -358,6 +358,7 @@ def test_remove_portfolio_member_self(client, user_session): == PortfolioRoleStatus.ACTIVE ) + def test_remove_portfolio_member_ppoc(client, user_session): portfolio = PortfolioFactory.create() @@ -384,5 +385,3 @@ def test_remove_portfolio_member_ppoc(client, user_session): PortfolioRoles.get(portfolio_id=portfolio.id, user_id=portfolio.owner.id).status == PortfolioRoleStatus.ACTIVE ) - -