[AmanGIT07]

Summary

DeleteOrganizationResource deletes a resource that belongs to an organization. Stacked on #1990.

Changes

• The authorization rule refuses a resource that is not an organization resource of the organization in the request, then checks delete on the resource and the plan entitlement on the organization.
• The delete keeps the row with deleted_at set, removes its SpiceDB tuples, and writes the audit log and the resource.deleted audit record naming the organization. resource.Service.Delete handles organization resources since feat(api): add CreateOrganizationResource #1987.
• DeleteProjectResource and DeleteOrganizationResource share getResourceToDelete and deleteResource. DeleteProjectResource keeps its project lookup, responses, and error messages.
• When the row is gone by the time of the delete, for example when two deletes run at once, deleteResource answers not found instead of internal error. This covers both delete RPCs.

Test Plan

• go test ./internal/api/v1beta1connect/ passes, with the existing DeleteProjectResource cases unchanged. New TestConnectHandler_DeleteOrganizationResource: not found, a failed lookup, a failed delete, a row deleted after the lookup, and success. New TestConnectHandler_DeleteProjectResource case: a row deleted after the lookup answers not found.
• e2e TestResourceAPI case 7: a member without the permission gets permission denied; the creator deletes the resource; a second delete gets not found; the creator no longer has update on it; creating the same name again returns a new id; after the organization is disabled, the creator gets failed precondition and a platform superuser can still delete it.
• go test ./test/e2e/... passes.
• golangci-lint run reports no issues.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Oct 16, 2026 8:56am UTC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: raystack/frontier/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4dbf7b98-7039-485b-99e6-4fc24406315b

📥 Commits

Reviewing files that changed from the base of the PR and between 620aea3 and 31c4121.

📒 Files selected for processing: 4

• internal/api/v1beta1connect/resource.go
• internal/api/v1beta1connect/resource_test.go
• pkg/server/connect_interceptors/authorization.go
• test/e2e/regression/api_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 38876961314

Coverage increased (+0.004%) to 55.244%

Details

• Coverage increased (+0.004%) from the base build.
• Patch coverage: 18 uncovered changes across 2 files (42 of 60 lines covered, 70.0%).
• 1 coverage regression across 1 file.

Uncovered Changes

File	Changed	Covered	%
pkg/server/connect_interceptors/authorization.go	16	0	0.0%
internal/api/v1beta1connect/resource.go	44	42	95.45%

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
internal/api/v1beta1connect/resource.go	1	92.81%

---

Coverage Stats

Relevant Lines:	41720
Covered Lines:	23048
Line Coverage:	55.24%
Coverage Strength:	19.13 hits per line

---

💛 - Coveralls

[AmanGIT07]

End to end against a local server, with Postgres and SpiceDB in Docker. The binary under test is the whole stack (#1985, #1986, #1987, #1989, #1990, #1991). The main column ran the same checks with the main binary on the same database. On main the new RPCs are in the proto but have no handler, so the interceptor denies them.

Check	main	this stack
Delete an org resource as its creator	permission denied	ok
Delete it again		not found
Member without the permission		permission denied
Another org's id in the request		permission denied (invalid arguments)
A project resource's id		permission denied (invalid arguments)
Database row after the delete		kept, deleted_at set
Live relations after the delete		0
resource.deleted audit record		names the org
Creator can still update it		no
Create the same name again		ok, new id
Disabled org: delete as a member		failed precondition
Disabled org: delete as a platform admin		ok
Delete a project resource / delete it again	ok / not found	ok / not found
Disabled org: delete a project resource as the org owner / as a platform admin	failed precondition / ok	failed precondition / ok

[rohilsurana]

The new RPC looks right. One small comment inline. My earlier question on #1987 about DeleteProjectResource returning Internal for an org resource also lands in this function (line 147).

[rohilsurana]

The not found fix is in for both delete RPCs and covered by tests. The open project resource question is tracked in #2001. Approving.