raystack / frontier / 27186856054

43%

main: 43%

Pull #1683

github

fix(role): reject deletion of a role still in use by policies

Deleting a role used to strip its app/role:<id>#<perm>@* tuples from SpiceDB
*before* the row delete. Because policies.role_id has a foreign key to
roles(id) with no ON DELETE rule, deleting an in-use role then failed the
row delete with an opaque 500 — after the permission tuples were already
gone, leaving a half-deleted role that still existed but granted nothing.

Make role deletion a clean guard instead of a destructive cascade: attempt
the row delete first, and only remove the permission tuples once it
succeeds. The role repository maps the foreign-key violation to a new
role.ErrInUse, which the handlers return as FailedPrecondition. Deleting a
role that still has policies is therefore rejected with a clear message and
zero side effects; the caller must remove those policies first.

This intentionally avoids cascading policy deletion, which would revoke
access for every principal granted the role and, for a widely-assigned
role, fan out into many serial SpiceDB deletes inside one request.

Adds unit tests for the in-use rejection / clean-delete paths and an e2e
test asserting an in-use role can't be deleted (FailedPrecondition, nothing
torn down) and deletes cleanly once its policy is removed.

Refs #1661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

10 of 18 new or added lines in 3 files covered. (55.56%)

16573 of 38103 relevant lines covered (43.5%)

12.19 hits per line