raystack / frontier / 30243145128

47%

main: 49%

Build Type

Pull #1807

github

Committed by whoAbhishekSah

Commit Message

fix(membership): clean custom-resource policies when removing an org member

RemoveOrganizationMember deleted a member's org, project, and group
policies but left their policies on custom resources in the org's
projects untouched. The policy row and its SpiceDB rolebinding tuple
stayed live, so an ex-member kept access to resources inside an org they
had been removed from. Deleting that user later orphaned the policy row.

The cascade now calls resource.RemovePrincipalAccess with the org's
project IDs, after the last-owner guard so a rejected removal changes
nothing. The deleter reaches the same cascade through
ForceRemoveOrganizationMember, so its own call is no longer needed.

Fixes #1801

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1807: fix(membership): clean custom-resource policies when removing an org member

Coverage Stats

20 of 21 new or added lines in 2 files covered. (95.24%)

276 existing lines in 3 files now uncovered.

18296 of 39003 relevant lines covered (46.91%)

14.36 hits per line