From 922f29fbc57b9bf226b7fddb2d00bbe2c98ada69 Mon Sep 17 00:00:00 2001
From: 7eliassen <ivan-smirnov-6909@mail.ru>
Date: Thu, 9 Jul 2026 17:20:29 +0300
Subject: [PATCH 1/2] feat: check is user try to delete himself

---
 src/presentation/http/router/noteSettings.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/presentation/http/router/noteSettings.ts b/src/presentation/http/router/noteSettings.ts
index 00a1b17a..ffc2ce54 100644
--- a/src/presentation/http/router/noteSettings.ts
+++ b/src/presentation/http/router/noteSettings.ts
@@ -203,6 +203,10 @@ const NoteSettingsRouter: FastifyPluginCallback<NoteSettingsRouterOptions> = (fa
       return reply.forbidden('You can\'t remove note\'s creator from the team');
     }
 
+    if (request.userId === request.body.userId) {
+      return reply.forbidden('You can\'t remove yourself from the team');
+    }
+
     const deletedTeamMemberId = await noteSettingsService.removeTeamMemberByUserIdAndNoteId(userId, noteId);
 
     if (deletedTeamMemberId === undefined) {

From bfefe603d7a9d7ee8436c78fec9195846cbe6861 Mon Sep 17 00:00:00 2001
From: 7eliassen <ivan-smirnov-6909@mail.ru>
Date: Mon, 20 Jul 2026 19:53:38 +0300
Subject: [PATCH 2/2] feat: add test

---
 .../http/router/noteSettings.test.ts          | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/src/presentation/http/router/noteSettings.test.ts b/src/presentation/http/router/noteSettings.test.ts
index 3043e07e..af418781 100644
--- a/src/presentation/http/router/noteSettings.test.ts
+++ b/src/presentation/http/router/noteSettings.test.ts
@@ -936,6 +936,42 @@ describe('NoteSettings API', () => {
 
       expect(response?.json().message).toBe('You can\'t remove note\'s creator from the team');
     });
+
+    test('Returns status code 403 and message "You can\'t remove yourself from the team"', async () => {
+      /** Create note creator */
+      const creator = await global.db.insertUser();
+      /** Create test user - member of the team, different from the creator */
+      const user = await global.db.insertUser();
+
+      /** Create test note */
+      const note = await global.db.insertNote({
+        creatorId: creator.id,
+      });
+
+      /** Add test user to the note with a Write role */
+      await global.db.insertNoteTeam({
+        noteId: note.id,
+        userId: user.id,
+        role: MemberRole.Write,
+      });
+
+      const accessToken = global.auth(user.id);
+
+      const response = await global.api?.fakeRequest({
+        method: 'DELETE',
+        headers: {
+          authorization: `Bearer ${accessToken}`,
+        },
+        url: `/note-settings/${note.publicId}/team`,
+        body: {
+          userId: user.id,
+        },
+      });
+
+      expect(response?.statusCode).toBe(403);
+
+      expect(response?.json().message).toBe('You can\'t remove yourself from the team');
+    });
   });
 
   describe('DELETE /:notePublicId/team', () => {