raystack / frontier / 25841154041

42%

main: 44%

Build Type

Pull #1608

github

Committed by whoAbhishekSah

Commit Message

fix(membership): atomic last-owner guard for SetGroupMemberRole

Applies the same TOCTOU fix from #1590 to the group path:

- validateMinGroupOwnerConstraint now returns the resolved group owner
  role ID alongside the error.
- SetGroupMemberRole passes that ID to replacePolicy so the owner-role
  delete uses DeleteWithMinRoleGuard (atomic in the DB) instead of a
  plain Delete after a stale read.
- replacePolicy returns the generic ErrLastOwnerRole on guard violation;
  SetGroupMemberRole converts it to ErrLastGroupOwnerRole so the handler
  error mapping and the user-facing message stay group-specific.

New unit test covers the race path: pre-check sees multiple owners, but
the DB guard reports the principal as the last owner at delete time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1608: refactor(group): migrate AddGroupUsers handler to membership

Coverage Stats

20 of 24 new or added lines in 3 files covered. (83.33%)

6 existing lines in 1 file now uncovered.

15879 of 37567 relevant lines covered (42.27%)

11.88 hits per line