IQ Tech Solutions.

26/09/2026

Ownership transfer succeeds, then the old owner loses the page. Trust the 204, clear private data, and never let an expected 403 overwrite success.

26/09/2026

What should a Blazor owner page do after it successfully gives ownership away?

Not reload itself. The next owner-only request should be forbidden because the caller is now a member. Episode 33 builds the safer flow: freeze both displayed membership versions, explain both sides of the role swap, submit once, and treat the server's 204 as authoritative.

Known conflicts reload the roster but never replay the command. Unknown outcomes lock mutations until a manual refresh. Confirmed success clears private data and explains that a renewed sign-in updates the session without restoring owner permission.

25/09/2026

What should a Blazor page do when a workspace member changes after the roster was loaded?

It should not guess, hide the row optimistically, or retry a destructive command with a newer version the owner never reviewed. Episode 32 builds the safer flow: load a no-store roster, capture the displayed member and version, confirm explicitly, let the ASP.NET Core server decide, and refresh afterward.

Known conflicts get clear recovery messages. Unknown failures retain the last roster for context but disable removal until a validated refresh succeeds. bUnit tests prove that refreshing during confirmation clears the old target, while the full Release suite keeps the server authorization and concurrency boundary intact.

Build web apps and services that run on Windows, Linux, and macOS using C #, HTML, CSS, and JavaScript. Get started for free on Windows, Linux, or macOS.

25/09/2026

A stale delete is a new decision. Refresh the Blazor roster, clear the pending target, and make the owner choose again. Never auto-retry destructive commands.

23/09/2026

Two SaveChanges calls can leave a workspace ownerless. Lock both membership rows, change both roles and versions, commit once, then race the real SQL Server path.

23/09/2026

A workspace ownership transfer can fail in the middle if it is implemented as two separate saves.

In Episode 31, the server treats ownership as one invariant. It derives the current workspace and owner from live authenticated state, locks the current owner and target member together, validates both roster versions, changes both roles, and commits once. Both membership versions advance, so old tokens cannot keep stale authority.

The integration proof races two transfers against SQL Server. One wins, the other receives a safe finite conflict, and the final database state has exactly one owner.

21/09/2026

21/09/2026

A member can be removed from a workspace while their chat connection is still open.

Episode 30 adds the missing real-time boundary. The server tracks which connection IDs belong to each workspace member, evicts the removed member from the SignalR group after the membership change commits, and checks live membership before every hub method.

We keep a real connection open in the test. Another member still receives chat; the removed member receives no later message and cannot save a new one. This is a single-server slice, with the scaling limit called out.

21/09/2026

Removing a member from one workspace should not blindly sign them out of every workspace.

Episode 29 builds a precise membership-revocation slice with .NET 10, ASP.NET Core and EF Core. Owners receive a small tenant-scoped roster, submit the version they reviewed, and the server protects owner accounts, stale decisions and foreign targets.

The command rechecks live ownership inside a serializable transaction so a demotion cannot slip between authorization and the write. It rotates Identity stamps only when the removed workspace is the user's current selection.

The proof reuses the old token: protected HTTP and new SignalR negotiation return 403, while unrelated workspace access remains valid.

21/09/2026

Revoke the workspace relationship, not every session. Use a server-scoped target, displayed version, commit-time owner recheck, and tests that prove the exact old token now gets 403.