raystack / frontier / 27183912904

43%

main: 43%

Build Type

Pull #1683

github

Committed by whoAbhishekSah

Commit Message

fix(role): cascade policy + rolebinding cleanup on role delete

Deleting a role removed its app/role:<id>#<perm> tuples and the role row,
but never touched the policies bound to it. Because policies.role_id has a
foreign key to roles(id) with no ON DELETE rule, deleting an in-use role
actually failed with a foreign-key violation -- after the role's permission
tuples had already been stripped from SpiceDB, leaving a half-deleted role
that still existed in the DB but granted nothing.

role.Delete now cascades first: it deletes every policy bound to the role
(which also removes each policy's app/rolebinding:<id> tuples), then the
role's permission tuples, then the role row.

Wiring: policy.Service gains DeleteAllByRole; role.Service gains a narrow
PolicyService interface injected via SetPolicyService after construction
(policy depends on role, so the back-reference can't be set at construction).

The org-delete cascade in core/deleter already deletes policies before
roles, so this introduces no double-delete there.

Adds an e2e regression test: create role + policy, delete the role, assert
no policy, rolebinding tuple, or role->permission tuple remains.

Refs #1661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1683: fix(role): cascade policy + rolebinding cleanup on role delete

Coverage Stats

0 of 25 new or added lines in 3 files covered. (0.0%)

1 existing line in 1 file now uncovered.

16562 of 38114 relevant lines covered (43.45%)

12.18 hits per line