feat(membership): realtime kick when admin removes a member

apps/api/plane/api/views/member.py

@@ -21,6 +21,10 @@
 )
 from plane.db.models import User, Workspace, WorkspaceMember, Project, ProjectMember
 from plane.utils.permissions import ProjectMemberPermission, WorkSpaceAdminPermission, ProjectAdminPermission
+from plane.utils.membership_realtime import (
+    EVENT_PROJECT_MEMBER_REMOVED,
+    publish_membership_removed,
+)
 from plane.utils.openapi import (
     WORKSPACE_SLUG_PARAMETER,
     PROJECT_ID_PARAMETER,
@@ -227,6 +231,14 @@ def delete(self, request, slug, project_id, pk):
         project_member = ProjectMember.objects.get(project_id=project_id, workspace__slug=slug, pk=pk)
         project_member.is_active = False
         project_member.save()
+        publish_membership_removed(
+            event_type=EVENT_PROJECT_MEMBER_REMOVED,
+            actor_id=request.user.id,
+            user_id=project_member.member_id,
+            workspace_id=project_member.workspace_id,
+            workspace_slug=slug,
+            project_id=project_id,
+        )
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 

apps/api/plane/app/views/project/member.py

@@ -22,6 +22,10 @@
 from plane.bgtasks.project_add_user_email_task import project_add_user_email
 from plane.utils.host import base_host
 from plane.app.permissions.base import allow_permission, ROLE
+from plane.utils.membership_realtime import (
+    EVENT_PROJECT_MEMBER_REMOVED,
+    publish_membership_removed,
+)
 
 
 class ProjectMemberViewSet(BaseViewSet):
@@ -280,10 +284,20 @@ def partial_update(self, request, slug, project_id, pk):
                     status=status.HTTP_403_FORBIDDEN,
                 )
 
+        was_active = project_member.is_active
         serializer = ProjectMemberSerializer(project_member, data=request.data, partial=True)
 
         if serializer.is_valid():
             serializer.save()
+            if was_active and serializer.instance.is_active is False:
+                publish_membership_removed(
+                    event_type=EVENT_PROJECT_MEMBER_REMOVED,
+                    actor_id=request.user.id,
+                    user_id=project_member.member_id,
+                    workspace_id=project_member.workspace_id,
+                    workspace_slug=slug,
+                    project_id=project_id,
+                )
             return Response(serializer.data, status=status.HTTP_200_OK)
         return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
 
@@ -318,6 +332,14 @@ def destroy(self, request, slug, project_id, pk):
 
         project_member.is_active = False
         project_member.save()
+        publish_membership_removed(
+            event_type=EVENT_PROJECT_MEMBER_REMOVED,
+            actor_id=request.user.id,
+            user_id=project_member.member_id,
+            workspace_id=project_member.workspace_id,
+            workspace_slug=slug,
+            project_id=project_id,
+        )
         return Response(status=status.HTTP_204_NO_CONTENT)
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])

apps/api/plane/app/views/workspace/member.py

@@ -23,6 +23,10 @@
 from plane.app.views.base import BaseAPIView
 from plane.db.models import Project, ProjectMember, WorkspaceMember, DraftIssue
 from plane.utils.cache import invalidate_cache
+from plane.utils.membership_realtime import (
+    EVENT_WORKSPACE_MEMBER_REMOVED,
+    publish_membership_removed,
+)
 
 from .. import BaseViewSet
 
@@ -147,6 +151,13 @@ def destroy(self, request, slug, pk):
 
         workspace_member.is_active = False
         workspace_member.save()
+        publish_membership_removed(
+            event_type=EVENT_WORKSPACE_MEMBER_REMOVED,
+            actor_id=request.user.id,
+            user_id=workspace_member.member_id,
+            workspace_id=workspace_member.workspace_id,
+            workspace_slug=slug,
+        )
         return Response(status=status.HTTP_204_NO_CONTENT)
 
     @invalidate_cache(

apps/api/plane/tests/unit/utils/test_membership_realtime.py

@@ -0,0 +1,60 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import pytest
+
+from plane.utils.membership_realtime import (
+    EVENT_PROJECT_MEMBER_REMOVED,
+    EVENT_WORKSPACE_MEMBER_REMOVED,
+    build_membership_removed_event,
+    membership_realtime_channel,
+)
+
+
+@pytest.mark.unit
+def test_membership_realtime_channel():
+    assert membership_realtime_channel("user-1") == "plane:membership:user-1"
+
+
+@pytest.mark.unit
+def test_build_workspace_member_removed_event():
+    event = build_membership_removed_event(
+        event_type=EVENT_WORKSPACE_MEMBER_REMOVED,
+        actor_id="admin-1",
+        user_id="user-1",
+        workspace_id="ws-1",
+        workspace_slug="acme",
+    )
+    assert event == {
+        "type": "workspace.member.removed",
+        "actor_id": "admin-1",
+        "user_id": "user-1",
+        "workspace_id": "ws-1",
+        "workspace_slug": "acme",
+        "project_id": None,
+    }
+
+
+@pytest.mark.unit
+def test_build_project_member_removed_event_requires_project_id():
+    assert (
+        build_membership_removed_event(
+            event_type=EVENT_PROJECT_MEMBER_REMOVED,
+            actor_id="admin-1",
+            user_id="user-1",
+            workspace_slug="acme",
+        )
+        is None
+    )
+
+    event = build_membership_removed_event(
+        event_type=EVENT_PROJECT_MEMBER_REMOVED,
+        actor_id="admin-1",
+        user_id="user-1",
+        workspace_id="ws-1",
+        workspace_slug="acme",
+        project_id="proj-1",
+    )
+    assert event["type"] == "project.member.removed"
+    assert event["project_id"] == "proj-1"

apps/api/plane/utils/membership_realtime.py

@@ -0,0 +1,77 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import json
+
+from django.core.serializers.json import DjangoJSONEncoder
+
+from plane.settings.redis import redis_instance
+from plane.utils.exception_logger import log_exception
+
+MEMBERSHIP_REALTIME_CHANNEL_PREFIX = "plane:membership:"
+
+EVENT_WORKSPACE_MEMBER_REMOVED = "workspace.member.removed"
+EVENT_PROJECT_MEMBER_REMOVED = "project.member.removed"
+
+
+def membership_realtime_channel(user_id) -> str:
+    return f"{MEMBERSHIP_REALTIME_CHANNEL_PREFIX}{user_id}"
+
+
+def build_membership_removed_event(
+    *,
+    event_type: str,
+    actor_id,
+    user_id,
+    workspace_id=None,
+    workspace_slug: str | None = None,
+    project_id=None,
+) -> dict | None:
+    if event_type not in {EVENT_WORKSPACE_MEMBER_REMOVED, EVENT_PROJECT_MEMBER_REMOVED}:
+        return None
+    if not user_id or not workspace_slug:
+        return None
+    if event_type == EVENT_PROJECT_MEMBER_REMOVED and not project_id:
+        return None
+
+    return {
+        "type": event_type,
+        "actor_id": str(actor_id) if actor_id else "",
+        "user_id": str(user_id),
+        "workspace_id": str(workspace_id) if workspace_id else "",
+        "workspace_slug": workspace_slug,
+        "project_id": str(project_id) if project_id else None,
+    }
+
+
+def publish_membership_removed(
+    *,
+    event_type: str,
+    actor_id,
+    user_id,
+    workspace_id=None,
+    workspace_slug: str | None = None,
+    project_id=None,
+) -> bool:
+    try:
+        event = build_membership_removed_event(
+            event_type=event_type,
+            actor_id=actor_id,
+            user_id=user_id,
+            workspace_id=workspace_id,
+            workspace_slug=workspace_slug,
+            project_id=project_id,
+        )
+        if event is None:
+            return False
+
+        ri = redis_instance()
+        ri.publish(
+            membership_realtime_channel(user_id),
+            json.dumps(event, cls=DjangoJSONEncoder),
+        )
+        return True
+    except Exception as e:
+        log_exception(e)
+        return False

apps/live/src/controllers/index.ts

@@ -7,6 +7,13 @@
 import { CollaborationController } from "./collaboration.controller";
 import { DocumentController } from "./document.controller";
 import { HealthController } from "./health.controller";
+import { MembershipController } from "./membership.controller";
 import { PdfExportController } from "./pdf-export.controller";
 
-export const CONTROLLERS = [CollaborationController, DocumentController, HealthController, PdfExportController];
+export const CONTROLLERS = [
+  CollaborationController,
+  DocumentController,
+  HealthController,
+  MembershipController,
+  PdfExportController,
+];

apps/live/src/controllers/membership.controller.ts

@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import type { Request } from "express";
+import type { WebSocket } from "ws";
+import { Controller, WebSocket as WSDecorator } from "@plane/decorators";
+import { logger } from "@plane/logger";
+import { handleAuthentication } from "@/lib/auth";
+import { membershipRealtimeHub } from "@/services/membership-realtime.service";
+
+@Controller("/membership")
+export class MembershipController {
+  [key: string]: unknown;
+
+  @WSDecorator("/")
+  handleConnection(ws: WebSocket, req: Request) {
+    void this.bindConnection(ws, req);
+  }
+
+  private async bindConnection(ws: WebSocket, req: Request) {
+    try {
+      const url = new URL(req.url || "", "http://localhost");
+      const userId = url.searchParams.get("userId") || "";
+      const cookie = req.headers.cookie?.toString();
+
+      if (!userId || !cookie) {
+        ws.close(4401, "Missing realtime credentials");
+        return;
+      }
+
+      await handleAuthentication({ cookie, userId });
+      await membershipRealtimeHub.addClient(ws, { userId });
+    } catch (error) {
+      logger.error("MEMBERSHIP_CONTROLLER: Failed to bind membership socket", error);
+      ws.close(1011, "Internal server error");
+    }
+  }
+}

apps/live/src/server.ts

@@ -23,6 +23,7 @@ import { env } from "@/env";
 import { HocusPocusServerManager } from "@/hocuspocus";
 // redis
 import { redisManager } from "@/redis";
+import { membershipRealtimeHub } from "@/services/membership-realtime.service";
 
 export class Server {
   private app: Express;
@@ -43,6 +44,8 @@ export class Server {
     try {
       await redisManager.initialize();
       logger.info("SERVER: Redis setup completed");
+      await membershipRealtimeHub.initialize();
+      logger.info("SERVER: Membership realtime hub initialized");
       const manager = HocusPocusServerManager.getInstance();
       this.hocuspocusServer = await manager.initialize();
       logger.info("SERVER: HocusPocus setup completed");