raystack / frontier / 25864418093

42%

main: 42%

Pull #1616

github

fix(bootstrap): backfill org policies for legacy service users on startup

Adds bootstrap.MigrateServiceUserOrgPolicies, which on each server start
finds service users that have an org#member@serviceuser SpiceDB relation
but no matching Postgres policy row and creates the missing policy.

Why: older versions of the membership-creation flow wrote the SpiceDB
relation directly without a corresponding policy. Once listing and
authorization paths read from Postgres policies (the direction the
codebase is moving), those legacy service users silently drop out of
"orgs I belong to" results. The backfill makes Postgres policies the
authoritative source without losing access for existing data.

Mechanics:

- internal/store/postgres/serviceuser_repository.go — new
  ListMissingOrgPolicy set-difference query. Returns
  []bootstrap.ServiceUserCandidate (id + org_id) for SU rows that have
  org_id set but no matching policies row. On a clean cluster the
  result set is empty and startup overhead is one query.
- internal/bootstrap/service.go — new MigrateServiceUserOrgPolicies
  method. Goes through policy.Service.Create so the three SpiceDB
  rolebinding tuples (rolebinding#bearer@su, rolebinding#role@role,
  org#granted@rolebinding) are written alongside the Postgres row,
  preserving Postgres↔SpiceDB consistency. Per-row failures are joined
  via errors.Join and logged with logger.WarnContext; the loop does
  not abort on a single bad row.
- cmd/serve.go — non-fatal wiring after MakeSuperUsers. Partial
  failures log a warning and continue, matching the shape of
  MetaSchemaService.List and SessionService.InitSessions above. The
  function stays in the codebase permanently so downstream deployments
  can pick it up on their own timeline.

DI additions to bootstrap.Service: logger, policyService (Create+List),
serviceuserRepo (ListMissingOrgPolicy). Constructor signature updated
in cmd/serve.go to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

0 of 88 new or added lines in 3 files covered. (0.0%)

15954 of 37739 relevant lines covered (42.27%)

11.87 hits per line