refactor(schema): drop the retired org/group ownership relations

[whoAbhishekSah]

Important

Keep as draft — merge only after the stored organization#owner, organization#member, and group#owner relations are cleaned up. SpiceDB rejects a schema that drops a relation while stored data still references it.

What this is

The last step of removing relation-based ownership: #1809 made the schema stop reading the org owner/member relations and the group owner relation, #1812 stopped writing them. This PR removes the declarations themselves, plus the code that only existed to clean up the old relations.

Changes

• base_schema.zed: app/organization loses its owner and member relations; app/group loses owner. The group member relation stays — roles granted to a group reach its members through it.
• Removing an org member no longer tries to delete org relations (none can exist); group membership cleanup deletes just the member relation.
• unlinkGroupFromOrg deletes only the group#org identity link.
• The e2e relation test now asserts that writing an org owner relation fails — the schema no longer has the relation, so the write is rejected. That locks the retirement in.

No behavior changes: everything here was already unreachable or a no-op after the cleanup.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 29, 2026 8:06am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cb783879-6b33-4620-9e40-71c13e088942

📥 Commits

Reviewing files that changed from the base of the PR and between 0145b65 and b3396db.

📒 Files selected for processing (5)

• core/membership/service.go
• core/membership/service_test.go
• internal/bootstrap/schema/base_schema.zed
• internal/bootstrap/testdata/compiled_schema.zed
• test/e2e/regression/api_test.go

💤 Files with no reviewable changes (2)

• internal/bootstrap/schema/base_schema.zed
• internal/bootstrap/testdata/compiled_schema.zed

---

📝 Walkthrough

Summary by CodeRabbit

• Authorization Updates

  • Removed direct organization owner/member and group owner relationships from the authorization model.
  • Group and organization membership changes now clean up only applicable member relationships.
  • Direct creation of unsupported owner relationships is now rejected.

• Bug Fixes

  • Improved cleanup behavior when removing members, deleting groups, or rolling back failed group creation.
  • Preserved access through supported policies and roles after membership changes.

Walkthrough

The PR removes obsolete organization and group ownership relations from authorization schemas and narrows membership cleanup to group member relations and group-to-organization identity links. Service, unit, and API regression tests are updated accordingly.

Changes

Relation cleanup narrowing

Layer / File(s)	Summary
Remove obsolete relation declarations internal/bootstrap/schema/base_schema.zed, internal/bootstrap/testdata/compiled_schema.zed	Organization member/owner and group owner relations are removed from the schemas and compiled schema artifact.
Narrow membership relation cleanup core/membership/service.go	Group removal paths delete only member relations, while unlinkGroupFromOrg deletes only the group-to-organization identity link.
Update cleanup and API regression coverage core/membership/service_test.go, test/e2e/regression/api_test.go	Tests now expect member-only cleanup, identity-link-only rollback, and rejection of direct owner relation creation before validating owner-role permissions.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• refactor: introduce resourceSpec + Member abstraction in membership package #1558 — Both changes align membership relation handling with the authorization schema by removing legacy relation usage.
• Centralize membership management into a dedicated package to fix leaky relations #1478 — Both modify membership service cleanup to remove redundant organization and group owner/member relation handling.

Possibly related PRs

• raystack/frontier#1809 — Directly overlaps with the schema and permission refactor removing organization and group owner/member relations.
• raystack/frontier#1611 — Adds group-member removal behavior whose owner/member relation effects are narrowed here.
• raystack/frontier#1812 — Adjusts group link/unlink and owner/member cleanup behavior in the same membership service.

Suggested reviewers: amangit07

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 30434159859

Coverage decreased (-0.007%) to 46.98%

Details

• Coverage decreased (-0.007%) from the base build.
• Patch coverage: 11 of 11 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	39085
Covered Lines:	18362
Line Coverage:	46.98%
Coverage Strength:	14.39 hits per line

---

💛 - Coveralls