fix(organisations): retain an active admin when cancelling users

`cancel_users` picked the earliest-joined admin without regard to
`is_active`. A deactivated admin could therefore be retained while every
active membership was deleted, leaving the organisation with no user
able to access it and no way to undo it.

Prefer the earliest active admin, fall back to the earliest active
member, and no-op when no seat is in use \u2014 which also removes the
latent `AttributeError` when the organisation has no admin at all.

Ref: #8368

Author: khvn26

api/organisations/models.py

@@ -209,21 +209,30 @@ def rebuild_environments(self):  # type: ignore[no-untyped-def]
         ).values_list("id", flat=True):
             rebuild_environment_document.delay(args=(environment_id,))
 
-    def cancel_users(self):  # type: ignore[no-untyped-def]
+    def cancel_users(self) -> None:
+        """
+        Reduce the organisation to the single seat the free plan allows.
+
+        The retained member must hold an active membership, otherwise the
+        organisation would be left with nobody able to access it.
+        """
+        active_memberships = UserOrganisation.objects.filter(
+            organisation=self,
+            is_active=True,
+        )
         remaining_seat_holder = (
-            UserOrganisation.objects.filter(
-                organisation=self,
-                role=OrganisationRole.ADMIN,
-            )
+            active_memberships.filter(role=OrganisationRole.ADMIN)
             .order_by("date_joined")
             .first()
+            or active_memberships.order_by("date_joined").first()
         )
+        if remaining_seat_holder is None:
+            # No seat is in use, so there is nothing to cancel down to.
+            return
 
         UserOrganisation.objects.filter(
             organisation=self,
-        ).exclude(
-            id=remaining_seat_holder.id  # type: ignore[union-attr]
-        ).delete()
+        ).exclude(id=remaining_seat_holder.id).delete()
 
 
 class UserOrganisation(LifecycleModelMixin, models.Model):  # type: ignore[misc]
@@ -389,7 +398,7 @@ def prepare_for_cancel(  # type: ignore[no-untyped-def]
 
         if cancellation_date <= timezone.now():
             # Since the date is immediate, wipe data right away.
-            self.organisation.cancel_users()  # type: ignore[no-untyped-call]
+            self.organisation.cancel_users()
             self.save_as_free_subscription()  # type: ignore[no-untyped-call]
             return
 

api/tests/unit/organisations/test_unit_organisations_deactivated_membership.py

@@ -1,5 +1,8 @@
+from datetime import timedelta
+
 import pytest
 from django.urls import reverse
+from django.utils import timezone
 from rest_framework import status
 from rest_framework.test import APIClient
 
@@ -243,3 +246,64 @@ def test_add_organisation__new_membership__is_active(
 
     # Then
     assert user.belongs_to(organisation.id) is True
+
+
+def test_cancel_users__deactivated_earliest_admin__retains_an_active_admin(
+    organisation: Organisation,
+    admin_user: FFAdminUser,
+    staff_user: FFAdminUser,
+) -> None:
+    # Given
+    # The earliest-joined admin has left and been deactivated, so retaining
+    # them would leave nobody able to access the organisation.
+    founding_admin = FFAdminUser.objects.create(email="founder@example.com")
+    founding_admin.add_organisation(organisation, role=OrganisationRole.ADMIN)
+    UserOrganisation.objects.filter(
+        user=founding_admin, organisation=organisation
+    ).update(date_joined=timezone.now() - timedelta(days=365))
+    founding_admin.set_organisation_membership_active(organisation, is_active=False)
+
+    # When
+    organisation.cancel_users()
+
+    # Then
+    assert admin_user.belongs_to(organisation.id) is True
+    assert organisation.num_seats == 1
+    assert not UserOrganisation.objects.filter(
+        user=founding_admin, organisation=organisation
+    ).exists()
+
+
+def test_cancel_users__no_active_admin__retains_earliest_active_member(
+    organisation: Organisation,
+    admin_user: FFAdminUser,
+    staff_user: FFAdminUser,
+) -> None:
+    # Given
+    # Every admin is deactivated, leaving only a regular member holding a seat.
+    admin_user.set_organisation_membership_active(organisation, is_active=False)
+
+    # When
+    organisation.cancel_users()
+
+    # Then
+    assert staff_user.belongs_to(organisation.id) is True
+    assert organisation.num_seats == 1
+
+
+def test_cancel_users__no_active_memberships__is_a_noop(
+    organisation: Organisation,
+    admin_user: FFAdminUser,
+    staff_user: FFAdminUser,
+) -> None:
+    # Given
+    # Nothing is holding a seat, so there is nothing to cancel down to.
+    admin_user.set_organisation_membership_active(organisation, is_active=False)
+    staff_user.set_organisation_membership_active(organisation, is_active=False)
+
+    # When
+    organisation.cancel_users()
+
+    # Then
+    assert organisation.num_seats == 0
+    assert UserOrganisation.objects.filter(organisation=organisation).count() == 2