raystack / frontier
42%
main: 44%

Repo Added 27 Jul 2023 06:58AM UTC

Token xRqMBdQBcqmLktLNAeQpRpj0YfJbkFc6Q regen

Build 5183 Last

Committed 14 May 2026 01:59PM UTC coverage: 42.275% (-0.1%) from 42.373%

Committed by

Commit Message

fix(bootstrap): backfill org policies for legacy service users on startup

Adds bootstrap.MigrateServiceUserOrgPolicies, which on each server start
finds service users that have an org#member@serviceuser SpiceDB relation
but no matching Postgres policy row and creates the missing policy.

Why: older versions of the membership-creation flow wrote the SpiceDB
relation directly without a corresponding policy. Once listing and
authorization paths read from Postgres policies (the direction the
codebase is moving), those legacy service users silently drop out of
"orgs I belong to" results. The backfill makes Postgres policies the
authoritative source without losing access for existing data.

Mechanics:

- internal/store/postgres/serviceuser_repository.go — new
  ListMissingOrgPolicy set-difference query. Returns
  []bootstrap.ServiceUserCandidate (id + org_id) for SU rows that have
  org_id set but no matching policies row. On a clean cluster the
  result set is empty and startup overhead is one query.
- internal/bootstrap/service.go — new MigrateServiceUserOrgPolicies
  method. Goes through policy.Service.Create so the three SpiceDB
  rolebinding tuples (rolebinding#bearer@su, rolebinding#role@role,
  org#granted@rolebinding) are written alongside the Postgres row,
  preserving Postgres↔SpiceDB consistency. Per-row failures are joined
  via errors.Join and logged with logger.WarnContext; the loop does
  not abort on a single bad row.
- cmd/serve.go — non-fatal wiring after MakeSuperUsers. Partial
  failures log a warning and continue, matching the shape of
  MetaSchemaService.List and SessionService.InitSessions above. The
  function stays in the codebase permanently so downstream deployments
  can pick it up on their own timeline.

DI additions to bootstrap.Service: logger, policyService (Create+List),
serviceuserRepo (ListMissingOrgPolicy). Constructor signature updated
in cmd/serve.go to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

0 of 88 new or added lines in 3 files covered. (0.0%)

15954 of 37739 relevant lines covered (42.27%)

11.87 hits per line

37739 RELEVANT LINES 15954 COVERED LINES

11.87 HITS PER LINE

Builds	Branch	Commit	Type	Ran	Committer	Via	Coverage
25864418093	fix/serviceuser-org-policy-backfill	fix(bootstrap): backfill org policies for legacy service users on startup Adds bootstrap.MigrateServiceUserOrgPolicies, which on each server start finds service users that have an org#member@serviceuser SpiceDB relation but no matching Postgres p...	Pull #1616	14 May 2026 02:07PM UTC	AmanGIT07	github	42.27

raystack / frontier
42%
main: 44%

raystack / frontier 42% main: 44%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

CHANGE BRANCH x

Relevant lines Covered

Source Files on fix/serviceuser-org-policy-backfill

Recent builds

raystack / frontier
42%
main: 44%

README BADGES
x

CHANGE BRANCH
x