raystack / frontier / 25713560362

42%

main: 43%

Build Type

Pull #1596

github

Committed by whoAbhishekSah

Commit Message

feat(membership): add group membership management

Introduces the SetGroupMemberRole RPC and three service methods on the
membership package: AddGroupMember, SetGroupMemberRole, and OnGroupCreated.
These manage policy + SpiceDB relation atomically and keep them in sync,
fixing the leaky-relation pattern at the group layer.

- AddGroupMember validates org membership of the principal and rejects
  duplicates with ErrAlreadyMember (service-only, no proto).
- SetGroupMemberRole rejects non-members with ErrNotMember and enforces
  a min-owner constraint (ErrLastGroupOwnerRole) on demotion.
- OnGroupCreated bundles the group<->org hierarchy relations with the
  initial owner add, so group.Create can wire SpiceDB with one call.
- Principal validation is restricted to app/user; the switch is kept
  extensible for future principal types.

Audit events are added for both the added and role-changed cases.

No call sites are migrated yet — group.Create, AddGroupUsers, and the
deletion of legacy group service methods will follow in subsequent PRs.

PROTON_COMMIT is temporarily pinned to the feature-branch SHA on
raystack/proton#485; it will be re-pinned to the merge commit once that
PR lands.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1596: feat(membership): add group membership management

Coverage Stats

239 of 293 new or added lines in 2 files covered. (81.57%)

137 existing lines in 3 files now uncovered.

15886 of 37561 relevant lines covered (42.29%)

11.87 hits per line