[AmanGIT07]

Summary

CreateOrganizationResource creates a resource that belongs to an organization and not to a project. Project and organization resources share one create path. Stacked on #1986.

Changes

• resource.Service.Create looks up the parent once with getParent: the organization when the resource has one and no project, else the project. One path then saves the row, links the parent in SpiceDB, adds the owner, and writes the resource.created audit record, which names the project or the organization.
• An organization resource's URN is frn:<org id>:<namespace>:<name>.
• resource.Service.Delete uses the same lookup, so its audit record works for both kinds.
• addParentToResource replaces AddProjectToResource, which only Create used.
• CreateProjectResource and CreateOrganizationResource share createResource in the handler. CreateProjectResource keeps its project lookup, responses, and error messages.
• CreateOrganizationResource returns not found for a missing organization.
• The authorization rule checks get on the organization, then the plan entitlement, as CreateProjectResource does on the project.
• getParent and the plan entitlement check read the organization with GetRaw. A disabled organization is then handled only by the organization state check in IsAuthorized: callers get failed precondition, and a platform superuser skips it, as on project resources.
• Resource responses include org_id.

Technical Details

• The proto requires org_id to be a UUID, so an organization name is not accepted.
• No rule ran the plan entitlement check on an organization before this one, so the GetRaw change does not touch existing RPCs.

Test Plan

• go test ./core/resource/ passes. New cases: the organization path (URN, organization link, owner, audit record naming the organization), a failed organization lookup that creates nothing, the exact project link and project audit record on create, and deleting an organization resource.
• go test ./internal/api/v1beta1connect/ passes, with the CreateProjectResource cases unchanged. New TestConnectHandler_CreateOrganizationResource: missing body, missing organization, bad detail, conflict, internal error, and success with org_id and no project. New TestCheckPlanEntitlement: a disabled organization passes.
• e2e TestResourceAPI case 5: a member creates a resource; the response has the organization, no project, and the URN; the creator can update it and another member cannot; creating it again returns the same id; after the organization is disabled, the member gets failed precondition and a platform superuser still creates one. With either GetRaw back to Get, the superuser's create fails.
• e2e TestPATScope_AllProjectsDoesNotReachOrgResources: a token scoped to all projects can update a resource in a project and cannot update a resource owned by the same organization. The PAT suite now seeds the compute permissions.
• go test ./test/e2e/... passes.
• golangci-lint run reports no issues.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Oct 16, 2026 8:25am UTC

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: raystack/frontier/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: fa3acf00-6f2b-4e26-b441-4fce32fe7d8f

📥 Commits

Reviewing files that changed from the base of the PR and between 281fa33 and 89ddff6.

📒 Files selected for processing: 10

• core/resource/resource.go
• core/resource/service.go
• core/resource/service_test.go
• internal/api/v1beta1connect/authorize.go
• internal/api/v1beta1connect/authorize_test.go
• internal/api/v1beta1connect/resource.go
• internal/api/v1beta1connect/resource_test.go
• pkg/server/connect_interceptors/authorization.go
• test/e2e/regression/api_test.go
• test/e2e/regression/pat_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 38873543560

Coverage increased (+0.07%) to 55.058%

Details

• Coverage increased (+0.07%) from the base build.
• Patch coverage: 25 uncovered changes across 3 files (106 of 131 lines covered, 80.92%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
pkg/server/connect_interceptors/authorization.go	12	0	0.0%
internal/api/v1beta1connect/resource.go	70	60	85.71%
core/resource/service.go	46	43	93.48%
Total (5 files)	131	106	80.92%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	41618
Covered Lines:	22914
Line Coverage:	55.06%
Coverage Strength:	19.08 hits per line

---

💛 - Coveralls

[AmanGIT07]

End to end against a local server, with Postgres and SpiceDB in Docker. The binary under test is the whole stack (#1985, #1986, #1987, #1989, #1990, #1991). The main column ran the same checks with the main binary on the same database. On main the new RPCs are in the proto but have no handler, so the interceptor denies them.

Check	main	this stack
Create an org resource as an org member	permission denied	ok
Response		org_id is the org, project_id empty, URN frn:<org id>:orgres/store:store-1, principal is the caller
Create it again with the same name		ok, same id
Caller is not an org member		permission denied
Org id is not a uuid		invalid argument
Org id does not exist		permission denied
Unknown namespace		invalid argument
Relations written		org to the org, owner to the caller
resource.created audit record		names the org
Disabled org: create as a member		failed precondition
Disabled org: create as a platform admin		ok

CreateProjectResource now shares the create path:

Check	main	this stack
Create a project resource	ok	ok, response has the project's org_id
Get and list project resources	ok	ok, each has the project's org_id
Relations written	owner, project	owner, project
resource.created audit record	names the project	names the project
Create it again with the same name	ok, same id, 2 audit records	ok, same id, 2 audit records
Unknown namespace	invalid argument	invalid argument
Disabled org: create as the org owner	failed precondition	failed precondition
Disabled org: create as a platform admin	ok	ok

[rohilsurana]

Four questions inline. One is about the re-create path, which was already like this for project resources. The other three are about how the project RPCs and the disabled org gate treat an org resource. None of them are about who may call the new RPC.

[rohilsurana]

My open questions are all tracked now (#2001, #2002), and the disabled org gate is fixed in #1990. Approving.