fix: atomic last-owner guard prevents TOCTOU race on role demotion#1590

Merged

rohilsurana merged 10 commits into

mainfrom

fix/toctou-last-owner-guard

May 13, 2026

Commits on May 13, 2026

fix: atomic last-owner guard prevents TOCTOU race on role demotion
rohilsurana
committed
fix: address review feedback on TOCTOU last-owner guard
rohilsurana
committed
fix: address round 2 review feedback
rohilsurana
committed
fix: move guarded org policy delete before relation cleanup in RemoveOrganizationMember
rohilsurana
committed
fix: run guarded owner delete before any sub-resource policy deletions
rohilsurana
committed
fix: differentiate guard rejection from concurrently deleted policy
rohilsurana
committed
fix: propagate non-ErrNoRows errors from existence re-check
rohilsurana
committed
fix: add ORDER BY to FOR UPDATE CTE to prevent deadlocks
rohilsurana
committed
refactor: extract cascadeRemovePrincipal and merge replacePolicy variants
rohilsurana
committed
fix: restore error logs for relation cleanup failures in cascadeRemovePrincipal
rohilsurana
committed