raystack / frontier
43%
main: 43%

Repo Added 27 Jul 2023 06:58AM UTC

Token xRqMBdQBcqmLktLNAeQpRpj0YfJbkFc6Q regen

Build 5080 Last

Committed 09 Jun 2026 05:55AM UTC coverage: 43.495% (+0.01%) from 43.481%

Committed by

Commit Message

fix(role): reject deletion of a role still in use by policies

Deleting a role used to strip its app/role:<id>#<perm>@* tuples from SpiceDB
*before* the row delete. Because policies.role_id has a foreign key to
roles(id) with no ON DELETE rule, deleting an in-use role then failed the
row delete with an opaque 500 — after the permission tuples were already
gone, leaving a half-deleted role that still existed but granted nothing.

Make role deletion a clean guard instead of a destructive cascade: attempt
the row delete first, and only remove the permission tuples once it
succeeds. The role repository maps the foreign-key violation to a new
role.ErrInUse, which the handlers return as FailedPrecondition. Deleting a
role that still has policies is therefore rejected with a clear message and
zero side effects; the caller must remove those policies first.

This intentionally avoids cascading policy deletion, which would revoke
access for every principal granted the role and, for a widely-assigned
role, fan out into many serial SpiceDB deletes inside one request.

Adds unit tests for the in-use rejection / clean-delete paths and an e2e
test asserting an in-use role can't be deleted (FailedPrecondition, nothing
torn down) and deletes cleanly once its policy is removed.

Refs #1661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

10 of 18 new or added lines in 3 files covered. (55.56%)

16573 of 38103 relevant lines covered (43.5%)

12.19 hits per line

38103 RELEVANT LINES 16573 COVERED LINES

12.19 HITS PER LINE

Builds	Branch	Commit	Type	Ran	Committer	Via	Coverage
27186856054	fix/role-delete-cascade-policies	fix(role): reject deletion of a role still in use by policies Deleting a role used to strip its app/role:<id>#<perm>@* tuples from SpiceDB before the row delete. Because policies.role_id has a foreign key to roles(id) with no ON DELETE rule, de...	Pull #1683	09 Jun 2026 06:00AM UTC	whoAbhishekSah	github	43.5
27186620928	fix/role-delete-cascade-policies	fix(role): reject deletion of a role still in use by policies Deleting a role used to strip its app/role:<id>#<perm>@* tuples from SpiceDB before the row delete. Because policies.role_id has a foreign key to roles(id) with no ON DELETE rule, de...	Pull #1683	09 Jun 2026 05:54AM UTC	whoAbhishekSah	github	43.5
27186498541	fix/role-delete-cascade-policies	fix(role): reject deletion of a role still in use by policies Deleting a role used to strip its app/role:<id>#<perm>@* tuples from SpiceDB before the row delete. Because policies.role_id has a foreign key to roles(id) with no ON DELETE rule, de...	Pull #1683	09 Jun 2026 05:50AM UTC	whoAbhishekSah	github	43.5
27186487884	fix/role-delete-cascade-policies	fix(role): reject deletion of a role still in use by policies Deleting a role used to strip its app/role:<id>#<perm>@* tuples from SpiceDB before the row delete. Because policies.role_id has a foreign key to roles(id) with no ON DELETE rule, de...	Pull #1683	09 Jun 2026 05:50AM UTC	whoAbhishekSah	github	43.5
27183912904	fix/role-delete-cascade-policies	fix(role): cascade policy + rolebinding cleanup on role delete Deleting a role removed its app/role:<id>#<perm> tuples and the role row, but never touched the policies bound to it. Because policies.role_id has a foreign key to roles(id) with no O...	Pull #1683	09 Jun 2026 04:34AM UTC	whoAbhishekSah	github	43.45
27123725335	fix/role-delete-cascade-policies	fix(role): cascade policy + rolebinding cleanup on role delete Deleting a role removed its app/role:<id>#<perm> tuples and the role row, but never touched the policies bound to it. Because policies.role_id has a foreign key to roles(id) with no O...	Pull #1683	08 Jun 2026 08:00AM UTC	whoAbhishekSah	github	43.38
27118135179	fix/role-delete-cascade-policies	fix(role): cascade policy + rolebinding cleanup on role delete Deleting a role removed its app/role:<id>#<perm> tuples and the role row, but never touched the policies bound to it. Because policies.role_id has a foreign key to roles(id) with no O...	Pull #1683	08 Jun 2026 05:40AM UTC	whoAbhishekSah	github	43.2
27115264838	fix/role-delete-cascade-policies	fix(role): cascade policy + rolebinding cleanup on role delete Deleting a role removed its app/role:<id>#<perm> tuples and the role row, but never touched the policies bound to it. Because policies.role_id has a foreign key to roles(id) with no O...	Pull #1683	08 Jun 2026 04:08AM UTC	whoAbhishekSah	github	43.19

raystack / frontier
43%
main: 43%

raystack / frontier 43% main: 43%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

CHANGE BRANCH x

Relevant lines Covered

Source Files on fix/role-delete-cascade-policies

Recent builds

raystack / frontier
43%
main: 43%

README BADGES
x

CHANGE BRANCH
x