check project owner is not removed

[rsiminel]

closes #498
@mboudet

Yup, all that was needed was a simple check that the user being deleted isn't the project owner (no need to check if it's the last member of the project because in that case they would be the project owner anyway).

[mboudet]

(no need to check if it's the last member of the project because in that case they would be the project owner anyway).

Not so sure about that. Currently, there is no check on the user deletion route regarding projects, and the project 'owner' is stored on the project itself. -> If we delete a user who is a project owner, it's still going to be the owner. So if there is another member of the project, it's going to be the last member of the project, but not the owner.

So, what is needed is a check on the 'user delete route': if the user we are trying to delete is the owner of the project, OR the last user, we abort and send an error message.

There is already a check for websites and DBs here: https://github.com/genouest/genouestaccountmanager/blob/master/routes/users.js#L529 , might as well add a check for project ownership.

[rsiminel]

If we delete a user who is a project owner, it's still going to be the owner. So if there is another member of the project, it's going to be the last member of the project, but not the owner.

So you're describing a case where the project owner's account was deleted before this PR?
Projet membership is stored on the user, so we'd have to look at every single user to see if one of them is in the same project.

Might I suggest 3 options:

• We load every single User from the db every time we delete an account. I'm assuming this is sub-optimal.
• We add a member_count attribute to the Project class.
• We add a check that all project owners correspond to existing user accounts. I prefer this solution in a 'two birds, one stone' kind of way.

[mboudet]

Might I suggest 3 options:

* We load every single User from the db every time we delete an account. I'm assuming this is sub-optimal.

Not THAT suboptimal, honestly. We don't delete users often (and we already do it for the groups when deleting an user).
Plus we do this query anytime we go to the admin page for a project anyway. A proper mongo query filtered on project membership is fairly fast.

* We add a member_count attribute to the Project class.

Not really fond of this one

* We add a check that all project owners correspond to existing user accounts. I prefer this solution in a 'two birds, one stone' kind of way.

Where would this check be, and how would it run? (And how would it communicate the issue to the admin?)