raystack / frontier / 26089607399

42%

main: 42%

Pull #1624

github

fix(authz): symmetric SpiceDB cleanup on policy delete

policy.AssignRole writes three tuples per policy but policy.Delete and
DeleteWithMinRoleGuard only swept the two where the rolebinding is the
Object (role_bearer, role). The resource-grant tuple — where the
rolebinding is the Subject — leaked on every per-member removal,
ownership swap, or cross-resource principal cleanup.

Add a second relation.Delete keyed by Subject on both delete paths via
a shared helper. The Subject-side delete tolerates relation.ErrNotExist
so resource-level wildcard sweeps in group.DeleteModel /
project.DeleteModel (which currently paper over the bug at full-resource
teardown) don't cause failures during the overlap period; those sweeps
become redundant for this tuple and can be removed in a follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

16 of 16 new or added lines in 1 file covered. (100.0%)

15987 of 37724 relevant lines covered (42.38%)

11.9 hits per line