refactor(schema): drop the retired org/group ownership relations - #1815
refactor(schema): drop the retired org/group ownership relations#1815whoAbhishekSah wants to merge 1 commit into
Conversation
Removes the owner and member relation declarations from app/organization and the owner relation from app/group. The schema stopped reading them (#1809) and Frontier stopped writing them (#1812); the per-environment data cleanup removes the stored tuples. This lands last because SpiceDB rejects a schema that drops a relation while stored data still uses it. The group member relation stays: roles granted to a group reach its members through it. Also removes the code that only existed to clean up the old tuples: - RemoveOrganizationMember no longer deletes org relations (none exist); group membership cleanup now deletes just the member relation. - unlinkGroupFromOrg deletes only the group#org identity link. - The e2e relation test asserts that writing an org owner relation now fails instead of asserting it grants nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Coverage Report for CI Build 30427276111Coverage decreased (-0.008%) to 46.893%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
2 participants
Important
Keep as draft — merge only after the stored
organization#owner,organization#member, andgroup#ownerrelations are cleaned up. SpiceDB rejects a schema that drops a relation while stored data still references it.What this is
The last step of removing relation-based ownership: #1809 made the schema stop reading the org
owner/memberrelations and the groupownerrelation, #1812 stopped writing them. This PR removes the declarations themselves, plus the code that only existed to clean up the old relations.Changes
base_schema.zed:app/organizationloses itsownerandmemberrelations;app/grouplosesowner. The groupmemberrelation stays — roles granted to a group reach its members through it.memberrelation.unlinkGroupFromOrgdeletes only thegroup#orgidentity link.ownerrelation fails — the schema no longer has the relation, so the write is rejected. That locks the retirement in.No behavior changes: everything here was already unreachable or a no-op after the cleanup.
🤖 Generated with Claude Code