fix(web): member management catches up with the signed removeOwner signature

removeOwner became removeOwner(account, accountId, wallet) in Task 4 (signed
edge-function call) but removeMember/leaveOrg in
supabase-member-management.ts still called it with the old 2-arg shape and
leaveOrg still deleted account_owners rows directly with the anon key. Both
now take the signing SigningAccount and route leave through the
org-membership edge function's "leave" action; the org/manage page threads
useActiveAccount() through to both call sites.

Author: MaxBrych

apps/web/src/app/app/org/manage/page.tsx

@@ -150,8 +150,8 @@ export default function OrgManagePage() {
   }
 
   const handleRemoveMember = async (wallet: string, name: string) => {
-    if (!accountId || !confirm(`${name} wirklich entfernen?`)) return
-    await removeMemberDB(accountId, wallet)
+    if (!accountId || !thirdwebAccount || !confirm(`${name} wirklich entfernen?`)) return
+    await removeMemberDB(thirdwebAccount, accountId, wallet)
     await load()
   }
 
@@ -163,9 +163,9 @@ export default function OrgManagePage() {
   }
 
   const handleLeave = async () => {
-    if (!accountId || !walletAddress) return
+    if (!accountId || !thirdwebAccount) return
     if (!confirm(`${activeAccount?.name || "Organisation"} wirklich verlassen?`)) return
-    await leaveOrgDB(accountId, walletAddress)
+    await leaveOrgDB(thirdwebAccount, accountId)
     await refreshAccounts()
     router.push("/app")
   }

apps/web/src/lib/supabase-member-management.ts

@@ -4,6 +4,7 @@
 
 import { supabase } from "./supabase";
 import { fetchAccountOwners, removeOwner } from "./supabase-accounts";
+import { callOrgMembership, type SigningAccount } from "./org-membership/client";
 import type { MemberWithProfile } from "@/types/account";
 
 /** Fetch all members of an account with their user profiles. */
@@ -51,38 +52,51 @@ export async function fetchMembersWithProfiles(
   return enriched;
 }
 
-/** Remove a member from an org (owner-only action). */
+/**
+ * Remove a member from an org (owner/admin action, or self-removal). Signed
+ * by `account`; threads through to removeOwner, which calls the
+ * org-membership edge function — no client-side pre-check needed, the edge
+ * function enforces the owner/admin gate and the last-owner invariant.
+ */
 export async function removeMember(
+  account: SigningAccount,
   accountId: string,
   walletAddress: string
 ): Promise<void> {
-  await removeOwner(accountId, walletAddress);
+  await removeOwner(account, accountId, walletAddress);
 }
 
-/** Leave an org voluntarily. Blocks if sole owner. */
+/**
+ * Leave an org voluntarily. Signed by `account` (the leaving wallet is
+ * derived server-side from the signature, never passed in the payload). The
+ * local owner-count check is a fast client-side UX shortcut only — the
+ * server enforces the real last-owner invariant via `delete_owner_guarded`
+ * and returns LAST_OWNER if this check was stale.
+ */
 export async function leaveOrg(
-  accountId: string,
-  walletAddress: string
+  account: SigningAccount,
+  accountId: string
 ): Promise<void> {
+  const walletAddress = account.address.toLowerCase();
   const owners = await fetchAccountOwners(accountId);
   const ownerCount = owners.filter((o) => o.role === "owner").length;
   const myRole = owners.find(
-    (o) => o.wallet_address === walletAddress.toLowerCase()
+    (o) => o.wallet_address.toLowerCase() === walletAddress
   )?.role;
 
+  const lastOwnerMessage =
+    "Du bist der einzige Inhaber. Übertrage die Inhaberschaft, bevor du die Organisation verlässt.";
+
   if (myRole === "owner" && ownerCount <= 1) {
-    throw new Error(
-      "Du bist der einzige Inhaber. Übertrage die Inhaberschaft, bevor du die Organisation verlässt."
-    );
+    throw new Error(lastOwnerMessage);
   }
 
-  const { error } = await supabase
-    .from("account_owners")
-    .delete()
-    .eq("account_id", accountId)
-    .eq("wallet_address", walletAddress.toLowerCase());
-
-  if (error) throw error;
+  const res = await callOrgMembership(account, "leave", { accountId });
+  if (!res.ok) {
+    if (res.code === "LAST_OWNER") throw new Error(lastOwnerMessage);
+    console.error("leaveOrg error:", res.code, res.message);
+    throw new Error(res.message || res.code || "leaveOrg failed");
+  }
 }
 
 /** Search users by name for the invite flow (excludes existing members). */