test(e2e): cover the user delete check end to end by AmanGIT07 · Pull Request #2028 · raystack/frontier

AmanGIT07 · 2026-10-26T17:00:41Z

Stacked on #2027. Merge #2027 first.

Summary

End-to-end tests for the user delete check in #2027. The admin user delete is refused while anything blocks it, and nothing changes. It deletes the orgs where the user is the only member. After a failed step, the next try continues from where the last one stopped.

Changes

test/e2e/regression/api_test.go: TestUserDeleteWithOrgs, six cases:
- The user is the only owner of an org with another member, and alone in an org whose offline billing account is at -30 tokens. The delete is refused with two violations, SOLE_OWNER_WITH_MEMBERS and NEGATIVE_TOKEN_BALANCE. The user, the orgs, the balance and the user's membership stay as they were. Once that org has a second owner and the usage is refunded, the delete goes through: the orgs where the user was alone are deleted, and the shared org stays without the user.
- A disabled member still counts, so the only owner of that org is refused.
- Orgs where the user is the only member are deleted with the user: an enabled one, a disabled one, and one whose only other member is a service user.
- A member of a disabled org leaves it. The org stays, and the user has no live policy on it.
- A disk in an org where the user is the only member refuses the delete with RESOURCES_EXIST, and the message names the org: user cannot be deleted yet: organization[user-delete-check-disk]: RESOURCES_EXIST. The user's other, empty org is not deleted. Once the disk is gone, the delete goes through.
- A trigger fails one write at a time: the project delete inside an org that goes with the user, the user's removal from another org, and the user row. Each try returns an error and stops at that step. The next try continues from there, and the last one deletes the user.
test/e2e/regression/billing_test.go: TestUserDeleteRefusedWhileAnOrgHasAPaidSubscription. A paid subscription in an org where the user is the only member refuses the delete with ACTIVE_SUBSCRIPTION. The user, the org and the subscription stay.
signUpUser and requireDeleteRefused are shared by both suites.

Technical Details

The users sign up and create their own orgs, so they are the only members. The disabled org case uses an org the admin created, so the admin stays its owner and the user only leaves it.
orgHasUser looks at both lists of ListOrganizationUsers. users hides deleted users, while role_pairs comes from the org's live policies, so only role_pairs would still show a policy left behind after the delete.
ListOrganizationUsers refuses a disabled org, so the disabled org case counts the user's live policies on it in the database.
A plain member leaving an enabled org is covered by TestUserDeleteLeavesNoAccessAndNoLivePolicy, from fix(deleter): user delete removes every policy the user holds #2022.
The billing suite runs stripe-mock, which answers every invoice list with the same draft invoice. The delete reads invoices from the provider, so it also reports that invoice as UNPAID_INVOICE. The test only checks that ACTIVE_SUBSCRIPTION is among the violations. An unpaid invoice cannot be set up locally for the delete.
The triggers work like the one in TestConsentInsertFailureRollsBackTheUser: fixed names and emails in the function bodies, no SQL built from strings, and a deferred cleanup that drops them even when the test fails. The trigger on users matches both a delete and a soft delete, so it keeps working after feat(store): user delete keeps the row #2023.
The server replaces the text of every internal error with a generic message, so the test cannot match the injected failure text. Each stop is pinned by what the steps before it leave behind instead:
- after the project failure, the project has no live policy but its row is live, because the project delete removes its policies before its row;
- after the removal failure, the org that goes with the user is gone, and the user is still in the other org and still signed in;
- after the user row failure, the user's session no longer works but the row is live, because the sessions end just before the row.
project.Service.DeleteModel removes a project's relations before its row. After the injected failure on the row, the API answers permission denied for that project, even to an admin, until a retry finishes the delete. The test checks the project row in the database instead.

Test Plan

Each case fails when the rule it covers is broken: the delete ignoring blockers, skipping the blockers of orgs that go with the user, a negative balance or a paid subscription not blocking, a disabled member not counting, a service user counting, a disabled org skipped, the orgs where the user is alone kept, and the delete carrying on after a failed org delete or a failed removal from an org.
The newer checks fail too when broken: a policy left on the shared org after the delete (found through role_pairs; the users list alone misses it), the removal from a disabled org failing, and an injected failure moved one step earlier (the project's policies, or the sessions).
go test ./test/e2e/... passes.
make lint reports no issues.

vercel · 2026-10-26T17:00:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Oct 28, 2026 2:54pm UTC

coderabbitai · 2026-10-26T17:00:50Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: raystack/frontier
Branch: test/user-delete-check
File: .coderabbit.yaml
Commit: 16df0ba
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: dfb4c5e2-053f-498a-b5e5-1ea9b793ae1b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coveralls · 2026-10-26T17:05:29Z

Coverage Report for CI Build 40710379612

Coverage remained the same at 55.922%

Details

Coverage remained the same as the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	42082
Covered Lines:	23533
Line Coverage:	55.92%
Coverage Strength:	19.66 hits per line

💛 - Coveralls

rohilsurana · 2026-10-28T07:25:26Z

+
+	_, err = s.testBench.Client.DeleteUser(ctxOrgAdminAuth, connect.NewRequest(&frontierv1beta1.DeleteUserRequest{Id: userID}))
+	_, violations := requireDeleteRefused(s.T(), err)
+	// stripe-mock answers every invoice list with the same draft invoice, so


This is a new code comment. Can we drop it? The PR description already explains the stripe-mock behavior.

Dropped in 16df0ba.

rohilsurana · 2026-10-28T07:25:26Z

+		s.Assert().False(userExists(userID))
+		s.Assert().False(orgIsLive(aloneOrgID))
+		s.Assert().True(orgIsLive(sharedOrgID))
+		s.Assert().False(orgIsLive(debtOrgID))


Can we also assert that the user left the shared org here, with orgHasUser(sharedOrgID, userID) false?

Added s.Assert().False(orgHasUser(sharedOrgID, userID)) after the delete in 16df0ba. With the role_pairs change below, it also catches a policy left on the shared org.

rohilsurana · 2026-10-28T07:25:26Z

+			s.Assert().NoError(err)
+		}()
+		requireFailedDelete := func() {
+			s.Require().Equal(connect.CodeInternal, connect.CodeOf(deleteUser(userID)))


This passes on any internal error. Can we also match the injected failure message, so we know it stopped at this step?

The server replaces the text of every internal error with a generic message (UnaryConnectErrorSanitizerInterceptor), so the injected text never reaches the test. Instead, 16df0ba pins each stop by what the steps before it leave behind:

after the project failure, the project has no live policy but its row is live;

after the removal failure, the alone org is gone, and the user is still in the shared org and still signed in;

after the user row failure, the user's session no longer works but the row is live.

Moving the project failure or the user row failure one step earlier now fails the test.

rohilsurana · 2026-10-28T07:25:26Z

+	orgHasUser := func(orgID, userID string) bool {
+		resp, err := s.testBench.Client.ListOrganizationUsers(ctxOrgAdminAuth, connect.NewRequest(&frontierv1beta1.ListOrganizationUsersRequest{Id: orgID}))
+		s.Require().NoError(err)
+		return slices.ContainsFunc(resp.Msg.GetUsers(), func(u *frontierv1beta1.User) bool { return u.GetId() == userID })


Nit: also check GetRolePairs(), so the deleted user is missing from both users and role_pairs.

orgHasUser now checks role_pairs too, in 16df0ba. users hides deleted users, so only role_pairs can show a policy left behind after the delete. Bringing the user's policy on the shared org back after the delete fails the new check and passes the old one.

rohilsurana · 2026-10-28T07:25:26Z

+		s.Assert().False(orgIsLive(debtOrgID))
+	})
+
+	s.Run("a disabled member keeps the only owner from leaving", func() {


Nit: there's no case for leaving a disabled org, or for a plain member leaving an org with other members. Worth adding one of each?

A plain member leaving an org with other members is covered by TestUserDeleteLeavesNoAccessAndNoLivePolicy: the user joins as a viewer, and after the delete there's no live policy and no entry in users or role_pairs. Added a case for leaving a disabled org in 16df0ba.

The admin user delete is refused with one violation per blocker across the user's orgs, including a negative token balance and a paid subscription, and nothing changes until the blockers are cleared. Orgs where the user is the only member are deleted with the user, including a disabled org and one whose only other member is a service user. A failure injected at the org delete, the removal from another org and the user row stops the delete, and each retry continues from where the last one stopped.

…disabled orgs

vercel Bot deployed to Preview October 26, 2026 17:01

View deployment

AmanGIT07 mentioned this pull request Oct 26, 2026

feat(deleter): user delete checks for blockers before deleting anything #2027

Open

13 tasks done

AmanGIT07 mentioned this pull request Oct 27, 2026

feat(api): users can check and delete their own account #2031

Open

10 tasks done

AmanGIT07 force-pushed the feat/user-delete-check branch from 1d4bf3c to 56bcc6a Compare October 27, 2026 12:12

AmanGIT07 force-pushed the test/user-delete-check branch from e75f617 to bf85b84 Compare October 27, 2026 12:12

vercel Bot deployed to Preview October 27, 2026 12:13

View deployment

rohilsurana reviewed Oct 28, 2026

View reviewed changes

AmanGIT07 added 2 commits October 28, 2026 19:01

test(e2e): user delete tests check role pairs, each failed step, and …

16df0ba

…disabled orgs

AmanGIT07 force-pushed the test/user-delete-check branch from bf85b84 to 16df0ba Compare October 28, 2026 14:53

vercel Bot deployed to Preview October 28, 2026 14:54

View deployment

Conversation

AmanGIT07 commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Technical Details

Test Plan

Uh oh!

vercel Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

coveralls commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 40710379612

Coverage remained the same at 55.922%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

AmanGIT07 commented Oct 26, 2026 •

edited

Loading

vercel Bot commented Oct 26, 2026 •

edited

Loading

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

coveralls commented Oct 26, 2026 •

edited

Loading