Protect workspace owner membership

app/projects/services/collaboration_service.py

@@ -89,6 +89,8 @@ class CollaborationService:
         target_membership = await self.repository.get_membership(workspace_id, target_user_id)
         if not target_membership:
              raise TeamMemberNotFoundError("Member not found.")
+        if target_membership.role == "owner":
+            raise CollaborationUnauthorizedError("Workspace owners cannot be removed.")
 
         if target_membership.role == 'admin':
             admin_count = await self.repository.count_workspace_admins(workspace_id)
@@ -108,15 +110,17 @@ class CollaborationService:
         ):
             raise CollaborationUnauthorizedError("Unauthorized: Only active workspace owners or admins can update member roles.")
 
-        # Prevent self-elevation
-        if actor_user_id == target_user_id and new_role == 'admin':
-            raise CollaborationUnauthorizedError("Cannot elevate your own privileges.")
+        # Prevent users from changing their own role, including self-demotion.
+        if actor_user_id == target_user_id:
+            raise CollaborationUnauthorizedError("Cannot change your own role.")
 
         if new_role not in {"admin", "member"}:
             raise ValueError("Member role must be admin or member.")
         target_membership = await self.repository.get_membership(workspace_id, target_user_id)
         if target_membership is None:
             raise TeamMemberNotFoundError("Member not found.")
+        if target_membership.role == "owner":
+            raise CollaborationUnauthorizedError("Workspace owners cannot be demoted.")
         if target_membership.role == "admin" and new_role != "admin":
             admin_count = await self.repository.count_workspace_admins(workspace_id)
             if admin_count <= 1: