feat: allow admin removing members from a network

go/internal/handler/handler.go

@@ -546,34 +546,28 @@ func (h *Handler) AddMembersToNetwork(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(resp)
 }
 
-// RemoveMemberFromNetwork removes a member from a network
+// RemoveMemberFromNetwork removes a member from a network. Admin-only.
+// Admins cannot remove themselves — doing so would leave networks.admin_human_id
+// dangling. Removal of a non-member is a no-op (204).
 func (h *Handler) RemoveMemberFromNetwork(w http.ResponseWriter, r *http.Request) {
-	humanId, ok := middleware.HumanIdFromContext(r.Context())
+	net, _, ok := h.loadNetworkForAdmin(w, r)
 	if !ok {
-		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return
 	}
 
-	networkID := r.PathValue("id")
 	memberHumanId := r.PathValue("humanId")
-	if networkID == "" || memberHumanId == "" {
-		http.Error(w, "network id and member humanId are required", http.StatusBadRequest)
+	if memberHumanId == "" {
+		http.Error(w, "member humanId is required", http.StatusBadRequest)
 		return
 	}
 
-	isMember, err := h.networkSvc.IsMember(r.Context(), networkID, humanId)
-	if err != nil {
-		slog.Error("failed to check network membership", "error", err, "network_id", networkID, "humanId", humanId)
-		http.Error(w, "internal server error", http.StatusInternalServerError)
-		return
-	}
-	if !isMember {
-		http.Error(w, "access denied", http.StatusForbidden)
+	if memberHumanId == net.AdminHumanId {
+		http.Error(w, "admin cannot remove themselves", http.StatusConflict)
 		return
 	}
 
-	if err := h.networkSvc.RemoveMember(r.Context(), networkID, memberHumanId); err != nil {
-		slog.Error("failed to remove member from network", "error", err, "network_id", networkID, "memberHumanId", memberHumanId)
+	if err := h.networkSvc.RemoveMember(r.Context(), net.ID, memberHumanId); err != nil {
+		slog.Error("failed to remove member from network", "error", err, "network_id", net.ID, "memberHumanId", memberHumanId)
 		http.Error(w, "internal server error", http.StatusInternalServerError)
 		return
 	}