[rohilsurana]

What changes

• Deleting an organization now removes the org's domains and its personal access tokens (PATs) before the org row.
• The new steps run after the invitations and kyc steps, and before the org policies and roles. They run before the owner policy goes, so a failure leaves the org owned and the owner can delete it again.
• Domains go through the existing domain delete, so each one is soft deleted and gets its audit record. Tokens go through DeleteAllByOrg from the PR below.
• A failure in either step stops the delete before the org policies and the org row, so the org can be deleted again.
• The deleter gets a DomainService interface and a DeleteAllByOrg method on its token interface. cmd/serve.go passes the domain service in.

Why

Today the database removes the domains and tokens through ON DELETE CASCADE when the org row goes. The next PR makes the org row delete soft, and a soft delete never triggers the cascade. This PR makes the code do that work first, so there is no point where domains or tokens stay live.

This PR is safe on its own. With the current hard delete, the domains and tokens are now removed one step earlier by the code instead of by the cascade.

Depends on

The PR that adds DeleteAllByOrg to the token service. This branch is stacked on it.

Tests

• Order: domains, tokens, org policies, roles, then the org row.
• A domain list failure, a domain delete failure and a token failure each stop before any org policy or role is removed.
• The existing org delete cases still pass with the two new steps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Oct 12, 2026 10:24am UTC

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: raystack/frontier/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1a1e3d90-0d53-46de-9784-b41744acbf8f

📥 Commits

Reviewing files that changed from the base of the PR and between b28bd18 and 14f0cf1.

📒 Files selected for processing (13)

• cmd/serve.go
• core/deleter/mocks/domain_service.go
• core/deleter/mocks/user_pat_service.go
• core/deleter/service.go
• core/deleter/service_test.go
• core/userpat/mocks/repository.go
• core/userpat/models/pat.go
• core/userpat/service.go
• core/userpat/service_test.go
• core/userpat/userpat.go
• internal/store/postgres/userpat.go
• internal/store/postgres/userpat_repository.go
• internal/store/postgres/userpat_repository_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 38235880511

Coverage decreased (-0.3%) to 54.41%

Details

• Coverage decreased (-0.3%) from the base build.
• Patch coverage: 1 uncovered change across 1 file (13 of 14 lines covered, 92.86%).
• 287 coverage regressions across 9 files.

Uncovered Changes

File	Changed	Covered	%
cmd/serve.go	1	0	0.0%
Total (2 files)	14	13	92.86%

Coverage Regressions

287 previously-covered lines in 9 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/store/postgres/policy_repository.go	91	74.41%
core/serviceuser/service.go	65	46.31%
internal/store/postgres/serviceuser_repository.go	45	49.43%
internal/store/postgres/serviceuser_credential_repository.go	31	61.7%
internal/bootstrap/bootstrapuser.go	22	72.64%
core/membership/service.go	16	88.31%
internal/api/v1beta1connect/serviceuser.go	12	89.51%
core/serviceuser/serviceuser.go	3	50.0%
internal/store/postgres/organization_repository.go	2	79.29%

---

Coverage Stats

Relevant Lines:	41450
Covered Lines:	22553
Line Coverage:	54.41%
Coverage Strength:	18.09 hits per line

---

💛 - Coveralls

[rohilsurana]

Changed the order of the new steps after review (commit ae9a41e).

Before, the domains and tokens were removed after the org policies and roles. The org policies include the owner policy. If a domain or token step failed at that point, the org row was still live but the owner had already lost access. A retry then answered permission denied, so only a superuser could finish the delete.

Now the domains and tokens go first, right after the invitations and kyc steps and before the org policies. A failure in either step leaves the org owned, and the owner can run the delete again. Nothing forces the old order. The domain delete only needs the org row, and removing a token's policies does not depend on the org policies.

The order is now: other children, domains, tokens, org policies, roles, and the org row last. The order test and the failure tests are updated. A new test covers a failed domain list.

[AmanGIT07]

Same case as the token loop in #1971: if someone deletes a domain while the org delete runs, domainService.Delete returns domain.ErrNotExist and the org delete stops until a retry. Can we skip domain.ErrNotExist in this loop as well?

[rohilsurana]

Fixed in 14f0cf1. The domain loop now skips domain.ErrNotExist and carries on with the next domain. Other errors still stop the delete. Added a test for it.