[AmanGIT07]

Summary

UpdateOrganizationResource updates a resource that belongs to an organization. Stacked on #1987.

Changes

• The authorization rule loads the resource and refuses it with permission denied when it is not an organization resource of the organization in the request, which covers a project resource sent to this RPC. It then checks update on the resource and the plan entitlement on the organization. The check that the resource belongs to the organization follows ensureRoleBelongToOrg.
• The disabled organization check reads the resource's org_id and falls back to its project for rows without one, so organization resources in a disabled organization return failed precondition.
• UpdateProjectResource and UpdateOrganizationResource share updateResource. UpdateProjectResource keeps its project lookup, responses, and error messages.
• resourceFromBody builds the resource from the request body for both create and update.

Technical Details

• The update writes the title and the metadata, as for project resources.
• Without the org_id read in the disabled organization check, an update in a disabled organization does not return failed precondition.

Test Plan

• go test ./internal/api/v1beta1connect/ passes, with the UpdateProjectResource cases unchanged. New TestConnectHandler_UpdateOrganizationResource: missing body, not found, bad detail, conflict, internal error, and success with org_id. New TestIsAuthorized case: an organization resource resolves to its disabled organization without a project lookup.
• e2e TestResourceAPI case 6: the creator updates the title and metadata; a member without the permission, another organization in the request, and a project resource id each get permission denied; a missing id gets not found; after the organization is disabled, the creator gets failed precondition and a platform superuser can still update it. With the org_id read removed, the creator's step no longer returns failed precondition.
• go test ./test/e2e/... passes.
• golangci-lint run reports no issues.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Oct 16, 2026 8:33am UTC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 51 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: raystack/frontier/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: d05b10bc-a12c-4b85-beec-b6237818776f

📥 Commits

Reviewing files that changed from the base of the PR and between 4770ecb and d74bc74.

📒 Files selected for processing: 6

• internal/api/v1beta1connect/authorize_test.go
• internal/api/v1beta1connect/org_state.go
• internal/api/v1beta1connect/resource.go
• internal/api/v1beta1connect/resource_test.go
• pkg/server/connect_interceptors/authorization.go
• test/e2e/regression/api_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 38874225151

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage decreased (-0.03%) to 55.03%

Details

• Coverage decreased (-0.03%) from the base build.
• Patch coverage: 36 uncovered changes across 2 files (64 of 100 lines covered, 64.0%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
pkg/server/connect_interceptors/authorization.go	28	0	0.0%
internal/api/v1beta1connect/resource.go	69	61	88.41%
Total (3 files)	100	64	64.0%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	41648
Covered Lines:	22919
Line Coverage:	55.03%
Coverage Strength:	19.09 hits per line

---

💛 - Coveralls

[AmanGIT07]

End to end against a local server, with Postgres and SpiceDB in Docker. The binary under test is the whole stack (#1985, #1986, #1987, #1989, #1990, #1991). The main column ran the same checks with the main binary on the same database. On main the new RPCs are in the proto but have no handler, so the interceptor denies them.

Check	main	this stack
Update an org resource as its creator	permission denied	ok, title and metadata saved, org_id kept
Member without the permission		permission denied
Another org's id in the request		permission denied (invalid arguments)
A project resource's id		permission denied (invalid arguments)
Unknown id		not found
Disabled org: update as a member		failed precondition
Disabled org: update as a platform admin		ok
Update a project resource	ok	ok
Disabled org: update a project resource as the org owner / as a platform admin	failed precondition / ok	failed precondition / ok

[rohilsurana]

The disabled org check now covers org resources, which fixes my earlier question on #1987. Approving, with two small comments inline.