feat(db): block deleting an org that still has service users

[whoAbhishekSah]

What

Adds a BEFORE DELETE trigger on organizations. If any serviceusers row still points at the org, the delete fails.

Why

Deleting an org used to leave its service users behind, with an org_id pointing at a row that no longer exists. Those leftover accounts kept authenticating. The app deleter now removes service users before the org, but the database had no fallback. This trigger is that fallback: if the app-level cleanup ever breaks, or a row is removed out of band, the org delete fails loudly instead of silently orphaning service users.

Normal deletes are unaffected — the deleter clears the service users first, so by the time the org row is deleted, the trigger has nothing to block.

Why a trigger and not a foreign key

The obvious fix is a foreign key on serviceusers.org_id with ON DELETE RESTRICT. That does not work here.

The bootstrap superuser service account lives under the virtual platform org (00000000-0000-0000-0000-000000000000). That org id is never inserted into the organizations table by design. A foreign key checks every row, so it would reject the bootstrap account and also fail on every server boot, which re-creates that account.

A trigger only runs when a real org is deleted. The platform org is never deleted, so the bootstrap account is never in scope. Same "fail loud" behaviour, no conflict with the special org id.

Testing

Verified locally against a running server:

• Service user authenticates before the org is deleted → 200.
• Raw DELETE FROM organizations while a service user still exists → blocked by the trigger.
• API DeleteOrganization → succeeds, and the service user rows are gone.
• Service user auth after the delete → 401.
• Server restart with the trigger in place → boots fine, bootstrap account re-created as normal.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 23, 2026 8:55am

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Prevented organizations from being deleted while service users are still associated with them.
  • Improved database behavior by safely removing this restriction during rollback when applicable.

Walkthrough

Adds a PostgreSQL trigger preventing deletion of organizations referenced by service users, with a down migration that removes the trigger and function.

Changes

Organization delete protection

Layer / File(s)	Summary
Organization delete trigger lifecycle internal/store/postgres/migrations/20260723120000_restrict_org_delete_with_serviceusers.*.sql	The up migration creates a BEFORE DELETE trigger that raises foreign_key_violation for referenced organizations; the down migration removes the trigger and function with guarded cleanup.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 29992856414

Coverage remained the same at 46.629%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	38894
Covered Lines:	18136
Line Coverage:	46.63%
Coverage Strength:	14.19 hits per line

---

💛 - Coveralls

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a015a5f-b611-4bca-841e-72f29dd3932c

📥 Commits

Reviewing files that changed from the base of the PR and between 9e063e3 and 10fee4b.

📒 Files selected for processing (2)

• internal/store/postgres/migrations/20260723120000_restrict_org_delete_with_serviceusers.down.sql
• internal/store/postgres/migrations/20260723120000_restrict_org_delete_with_serviceusers.up.sql

[whoAbhishekSah]

part of #1585