update remove_user_as_admin

backend/main.py

@@ -20,6 +20,7 @@ from auth import (
 from permissions import (
     has_role,
     whoami,
+    get_member_role,
 )
 
 from rooms import (
@@ -372,23 +373,40 @@ def api_leave_room(
     }
 
 @app.delete("/rooms/{room_id}/members/{user_id}")
-def remove_user_as_admin(
+def api_remove_member(
     room_id: int,
     user_id: int,
     current_user: int = Depends(get_current_user),
 ):
-    if not has_role(room_id, current_user, "admin"):
+    current_role = get_member_role(room_id, current_user)
+    target_role = get_member_role(room_id, user_id)
+
+    if current_role is None:
+        raise HTTPException(
+            status_code=403,
+            detail="not a room member",
+        )
+
+    if target_role is None:
+        raise HTTPException(
+            status_code=404,
+            detail="user is not a member of this room",
+        )
+
+    if current_role < 2:
         raise HTTPException(
             status_code=403,
             detail="admin permission required",
         )
 
-    if not remove_room_member(room_id, user_id):
+    if target_role >= current_role:
         raise HTTPException(
-            status_code=404,
-            detail="user is not a member of this room",
+            status_code=403,
+            detail="cannot remove a member with equal or higher role",
         )
 
+    remove_room_member(room_id, user_id)
+
     return {
         "status": "removed",
         "user_id": user_id,