version 0.0.24

backend/src/routes/groups.js

@@ -116,6 +116,23 @@ router.post('/:id/members', authMiddleware, (req, res) => {
   res.json({ success: true });
 });
 
+// Remove a member from a private group (owner or admin only)
+router.delete('/:id/members/:userId', authMiddleware, (req, res) => {
+  const db = getDb();
+  const group = db.prepare('SELECT * FROM groups WHERE id = ?').get(req.params.id);
+  if (!group) return res.status(404).json({ error: 'Group not found' });
+  if (group.type !== 'private') return res.status(400).json({ error: 'Cannot remove members from public groups' });
+  if (group.owner_id !== req.user.id && req.user.role !== 'admin') {
+    return res.status(403).json({ error: 'Only owner or admin can remove members' });
+  }
+  const targetId = parseInt(req.params.userId);
+  if (targetId === group.owner_id) {
+    return res.status(400).json({ error: 'Cannot remove the group owner' });
+  }
+  db.prepare('DELETE FROM group_members WHERE group_id = ? AND user_id = ?').run(group.id, targetId);
+  res.json({ success: true });
+});
+
 // Leave private group
 router.delete('/:id/leave', authMiddleware, (req, res) => {
   const db = getDb();