[AmanGIT07]

Summary

Adds an e2e test for the organization delete. After DeleteOrganization, nobody who had access can get the org, its projects or a resource inside one; no live policy is left on them; no live policy names the deleted group or service user; and the rows stay with deleted_at set. Test only.

Changes

• test/e2e/regression/api_test.go: TestOrganizationDeleteLeavesNoAccessAndNoLivePolicy.

Technical Details

• The org has an enabled project, a disabled project, a compute/order resource in the enabled project, a group and a service user. Users get access through the org owner role, the org viewer role, a direct project policy, the group, and a role on the resource; the service user through a project policy.
• Before the delete, the test checks that each of them has the access it was given, and that live policies exist on every object and principal it checks afterwards.
• Access is checked with CheckFederatedResourcePermission. With ids it asks SpiceDB only, so a deleted object answers false.
• An org delete does not delete users, so the policy check by principal covers the group and the service user.
• A personal access token of a deleted org stops working; TestPATOfDeletedOrgStopsAuthenticating in pat_test.go covers it.

Test Plan

• The new test passes.
• It fails when the cascade misses a step:
  • projects skipped: access is left on the project and the resource;
  • resources skipped: access is left on the resource;
  • project policies skipped: live policies are left on both projects;
  • org policies skipped: live policies are left on the org;
  • service users skipped: the service user row is not marked deleted;
  • resource policies skipped: a live policy is left on the resource.
• go test ./test/e2e/... passes.
• golangci-lint run ./test/e2e/regression/... reports no issues.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Oct 27, 2026 10:05am UTC

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: raystack/frontier
• Branch: test/org-delete-acceptance
• File: .coderabbit.yaml
• Commit: 1468388
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4555ada8-ad29-4140-bf68-45820195336f

Commits

Reviewing files that changed from the base of the PR and between 142efb8 and 1468388.

Files selected for processing: 1

• test/e2e/regression/api_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Summary

Summary by CodeRabbit

• Tests
  • Added regression coverage verifying that deleting an organization revokes access to its projects and resources for direct users, group members, and service users.
  • Confirmed deletion removes active policies and group relationships, including those associated with the organization’s projects, groups, and resources.
  • Verified that the organization and its related records, including disabled projects and service users, remain marked as deleted.

Adds an end-to-end regression test for organization deletion. The test checks access before deletion, then verifies access revocation, policy and group-relation cleanup, and retained database records marked deleted.

Changes: Organization Deletion

Layer / File(s)	Summary
Create principals and verify pre-deletion access test/e2e/regression/api_test.go	Creates enabled and disabled projects, a resource, users, a group, and a service user. Adds policies and checks expected access before deletion.
Verify post-deletion cleanup test/e2e/regression/api_test.go	Checks that subjects lose access, live policies and group relations are removed, and organization, project, group, service-user, and resource records remain marked deleted.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Possibly related PRs

• raystack/frontier#2022: Adds policy cleanup and regression coverage for deleted-user authorization state.

Suggested reviewers: rohilsurana

Merge Risk: Minimal · up to 14683

No actionable merge-blocking issue was established; the organization-deletion test is ready for normal merge checks.

Pre-merge checks: 2

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 40485784633

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage increased (+0.007%) to 55.736%

Details

• Coverage increased (+0.007%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 68 coverage regressions across 2 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

68 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/api/v1beta1connect/organization.go	36	63.35%
internal/store/postgres/organization_repository.go	32	79.31%

---

Coverage Stats

Relevant Lines:	41937
Covered Lines:	23374
Line Coverage:	55.74%
Coverage Strength:	19.51 hits per line

---

💛 - Coveralls