raystack / frontier / 30347385525

47%

main: 48%

Build Type

Pull #1812

github

Committed by whoAbhishekSah

Commit Message

refactor(membership): stop writing org owner/member relations

Since the schema stopped reading the owner and member relations on
organizations (#1809), writing them on every membership change is dead
work. Stop writing them:

- AddOrganizationMember and SetOrganizationMemberRole no longer write
  or replace org relations. The service user identity link
  (serviceuser#org@organization) is still written — the schema reads it
  to resolve the manage permission.
- Groups always write the member relation now, never owner. The member
  relation stays because role grants to a group flow through
  group#member. This also fixes a real bug: a role granted to a group
  never reached the group's own owner, because owners got an owner
  relation instead of member. Group owners now receive group-granted
  roles like every other member.
- Group role changes migrate a legacy owner relation to member.
- linkGroupToOrg no longer writes organization#member@group#member; it
  granted nothing after the schema change. The removal paths still
  delete it (and the org owner/member relations) so members and groups
  from before this change leave no stale data behind.
- Delete the orgRoleToRelation/groupRoleToRelation mapping helpers.

The relations stay declared in the schema until the existing tuples are
cleaned up; SpiceDB cannot drop a relation while data references it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Pull Request Pull Request #1812: refactor(membership): stop writing org owner/member relations

Coverage Stats

4 of 5 new or added lines in 1 file covered. (80.0%)

153 existing lines in 1 file now uncovered.

18263 of 38945 relevant lines covered (46.89%)

14.36 hits per line