1 files changed, 48 insertions, 0 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 83feeb4..74c6c9e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -276,6 +276,54 @@ async def create_group(
     return {"group_id": group.id, "name": group.name}
 
 
+@router.delete("/{group_id}/members/{username}")
+async def remove_group_member(
+    group_id: str,
+    username: str,
+    request: Request,
+    current_user: User = Depends(require_user_scope),
+    db: AsyncSession = Depends(get_db),
+):
+    """
+    Remove someone from a group. The group's owner only.
+
+    This is half of removing a member, and the half the hub can do: without a
+    membership row they cannot reach the node through signaling, and their next
+    token will not name this group. What it does not do is make the node forget
+    them — the node's roster decides who it serves, and only a paired operator
+    can change that (`member_revoke` over MNP, or `meshbay-node member revoke`).
+    The browser does both; a caller using this endpoint alone should know it did
+    one.
+    """
+    group = await db.get(Group, group_id)
+    if not group:
+        raise HTTPException(status_code=404, detail="Group not found")
+    if group.admin_id != current_user.id:
+        raise HTTPException(status_code=403,
+                            detail="Only the group owner can remove members")
+
+    target = (await db.execute(
+        select(User).where(User.username == username))).scalar_one_or_none()
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+    if target.id == group.admin_id:
+        raise HTTPException(
+            status_code=409,
+            detail="The owner cannot be removed from their own group. Hand the "
+                   "group over or delete it.")
+
+    membership = await db.get(GroupMember, (group_id, target.id))
+    if not membership:
+        raise HTTPException(status_code=404, detail="Not a member of this group")
+
+    await db.delete(membership)
+    db.add(IPLog(user_id=current_user.id, event="group_leave",
+                 ip_address=client_ip(request),
+                 detail=f"{username} removed from {group.name}"))
+    await db.commit()
+    return {"status": "removed", "group_id": group_id, "username": username}
+
+
 class GroupUpdateRequest(BaseModel):
     description: str | None = None