From d026de4ec106071233971f241ae955f12129033a Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Thu, 6 Nov 2025 16:45:05 -0800 Subject: [PATCH] fix: only check for delete protection if deleting org identity, not sub-org identity membership --- backend/src/services/identity/identity-service.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/services/identity/identity-service.ts b/backend/src/services/identity/identity-service.ts index d9baaa2f5..cf8d185c0 100644 --- a/backend/src/services/identity/identity-service.ts +++ b/backend/src/services/identity/identity-service.ts @@ -329,14 +329,14 @@ export const identityServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Delete, OrgPermissionSubjects.Identity); - if (identityOrgMembership.identity.hasDeleteProtection) - throw new BadRequestError({ message: "Identity has delete protection" }); - if (identityOrgMembership.identity.projectId) { throw new BadRequestError({ message: `Identity is managed by project` }); } if (identityOrgMembership.identity.orgId === actorOrgId) { + if (identityOrgMembership.identity.hasDeleteProtection) + throw new BadRequestError({ message: "Identity has delete protection" }); + const deletedIdentity = await identityDAL.deleteById(id); await licenseService.updateSubscriptionOrgMemberCount(identityOrgMembership.scopeOrgId); return { ...deletedIdentity, orgId: identityOrgMembership.scopeOrgId };