Summary
Removing a team member currently updates the user to a temporary account, but there are unfinished side effects called out in code:
session cleanup is missing
behavior for last user removed from a team is missing
Problem
Current behavior can leave stale login/session state after a user is removed from a team, which may cause UI/backend desync.
Also, when team membership reaches zero, there is no explicit lifecycle handling for that team/account state.
Expected Behavior
When a user is removed from a team, any active session context tied to old team membership should be invalidated or refreshed safely.
If a team ends up with no users, system behavior should be explicit and consistent (soft-delete/archive/no-op as defined by maintainers).
Existing self-delete protection should remain unchanged.
Proposed Approach
Add session invalidation or session-refresh mechanism after reassignment/removal flow.
Add explicit handling for zero remaining users in the original team/account.
Add/extend integration tests for:
successful removal path
session consistency after removal
last-user-removed behavior
no regressions for self-delete guard and user-not-found flow
Acceptance Criteria
Team user removal flow has no stale session side effects.
Empty-team behavior is deterministic and documented in code/comments.
Tests cover the new behavior and pass in CI.
No regression in existing deleteTeamUser endpoint responses.
Summary
Removing a team member currently updates the user to a temporary account, but there are unfinished side effects called out in code:
session cleanup is missing
behavior for last user removed from a team is missing
Problem
Current behavior can leave stale login/session state after a user is removed from a team, which may cause UI/backend desync.
Also, when team membership reaches zero, there is no explicit lifecycle handling for that team/account state.
Expected Behavior
When a user is removed from a team, any active session context tied to old team membership should be invalidated or refreshed safely.
If a team ends up with no users, system behavior should be explicit and consistent (soft-delete/archive/no-op as defined by maintainers).
Existing self-delete protection should remain unchanged.
Proposed Approach
Add session invalidation or session-refresh mechanism after reassignment/removal flow.
Add explicit handling for zero remaining users in the original team/account.
Add/extend integration tests for:
successful removal path
session consistency after removal
last-user-removed behavior
no regressions for self-delete guard and user-not-found flow
Acceptance Criteria
Team user removal flow has no stale session side effects.
Empty-team behavior is deterministic and documented in code/comments.
Tests cover the new behavior and pass in CI.
No regression in existing deleteTeamUser endpoint responses.