The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	May 13, 2026 11:08am

No actionable comments were generated in the recent review. 🎉

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Coverage Report for CI Build 25795292940

Coverage decreased (-0.04%) to 42.249%

Details

• Coverage decreased (-0.04%) from the base build.
• Patch coverage: 80 uncovered changes across 3 files (46 of 126 lines covered, 36.51%).
• 48 coverage regressions across 1 file.

Uncovered Changes

Coverage Regressions

48 previously-covered lines in 1 file lost coverage.

Coverage Stats

Relevant Lines:	37646
Covered Lines:	15905
Line Coverage:	42.25%
Coverage Strength:	11.88 hits per line

💛 - Coveralls

@rohilsurana PR looks good, a few points worth looking:

1. RemoveOrganizationMember tests don't exercise the new guard path.
The second policySvc.List mocks in the cascade tests return policies without RoleID, so the Phase 2 check pol.RoleID == ownerRoleID is always false and DeleteWithMinRoleGuard is silently skipped. Set RoleID: ownerRoleID on the org policy in those mocks and switch the expectation to DeleteWithMinRoleGuard. Add a test mirroring the new SetOrganizationMemberRole case where the repo returns ErrLastRoleGuard and we expect ErrLastOwnerRole.

2. No integration test for the new SQL.
policy_repository_test.go already uses dockertest; please add TestDeleteWithMinRoleGuard covering: happy path, last-owner rejection, concurrent demotion (two goroutines + pg_sleep), non-guard-role policy (the defensive branch), and concurrent deletion between Get and the txn.

3. Retry-semantics regression in RemoveOrganizationMember.
The pre-PR ordering deleted org policies last so a partial failure in sub-resource cleanup or relations was retryable — the org policy still existed, so membership check passed. The new ordering deletes the org owner policy first, so any failure in Phase 3/4 leaves orphaned policies/relations and a retry returns ErrNotMember. Either document this in the godoc and provide operator cleanup tooling, or accept it as a known trade-off.

4. No log on partial failure in policy.Service.DeleteWithMinRoleGuard. If DB commits but relationService.Delete fails, SpiceDB has stale bearer/role tuples for a now-deleted policy. Mirror the structured log used in replacePolicyWithOwnerGuard.

Suggested refactor

RemoveOrganizationMember reads as four numbered phases inline; the natural shape is validate → guard → cascade. Two extractions cut ~70 lines and remove the Phase N comments.

1. Extract the cascade. RemoveOrganizationMember keeps only validation + the guard loop + audit; everything else moves into cascadeRemovePrincipal(ctx, org, principalID, principalType, ownerRoleID) which classifies, deletes non-owner org + sub-resource policies, and removes SpiceDB relations.

2. Merge replacePolicyWithOwnerGuard and replacePolicy into one method + a deletePolicy helper:

func (s *Service) replacePolicy(ctx context.Context, ..., existing []policy.Policy, ownerRoleID string) error {                                                                        
    for _, p := range existing {                                                                                                                                                         
        if err := s.deletePolicy(ctx, p, ownerRoleID); err != nil {
            if errors.Is(err, policy.ErrLastRoleGuard) { return ErrLastOwnerRole }                                                                                                       
            return fmt.Errorf("delete policy %s: %w", p.ID, err)                                                                                                                         
        }
    }                                                                                                                                                                                    
    // ... createPolicy                                                                                                                                                                  
}
                                                                                                                                                                                         
func (s *Service) deletePolicy(ctx context.Context, pol policy.Policy, ownerRoleID string) error {                                                                                     
    if ownerRoleID != "" && pol.RoleID == ownerRoleID {
        return s.policyService.DeleteWithMinRoleGuard(ctx, pol.ID, ownerRoleID)                                                                                                          
    }                                                                                                                                                                                    
    return s.policyService.Delete(ctx, pol.ID)                                                                                                                                           
}