feat: org soft-deletion

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/controlplane/pkg/biz/organization.go

@@ -242,14 +242,7 @@ func (uc *OrganizationUseCase) FindByName(ctx context.Context, name string) (*Or
 	return org, nil
 }
 
-// Delete deletes an organization and all relevant data
-// This includes:
-// - The organization
-// - The associated repositories
-// - The associated integrations
-// The reason for just deleting these two associated components only is because
-// they have external secrets that need to be deleted as well, and for that we leverage their own delete methods
-// The rest of the data gets removed by the database cascade delete
+// Delete soft-deletes an organization and all relevant data
 func (uc *OrganizationUseCase) Delete(ctx context.Context, id string) error {
 	orgUUID, err := uuid.Parse(id)
 	if err != nil {
@@ -263,30 +256,21 @@ func (uc *OrganizationUseCase) Delete(ctx context.Context, id string) error {
 		return NewErrNotFound("organization")
 	}
 
-	// Delete all the integrations
-	integrations, err := uc.integrationUC.List(ctx, id)
+	// Delete all memberships for this organization
+	// Memberships should be removed when an organization is soft-deleted
+	// since they represent access rights that should be revoked
+	memberships, _, err := uc.membershipRepo.FindByOrg(ctx, orgUUID, nil, nil)
 	if err != nil {
-		return err
-	}
-
-	for _, i := range integrations {
-		if err := uc.integrationUC.Delete(ctx, id, i.ID.String()); err != nil {
-			return err
-		}
-	}
-
-	backends, err := uc.casBackendUseCase.List(ctx, org.ID)
-	if err != nil {
-		return fmt.Errorf("failed to list backends: %w", err)
+		return fmt.Errorf("failed to find memberships: %w", err)
 	}
 
-	for _, b := range backends {
-		if err := uc.casBackendUseCase.Delete(ctx, b.ID.String()); err != nil {
-			return fmt.Errorf("failed to delete backend: %w", err)
+	for _, m := range memberships {
+		if err := uc.membershipRepo.Delete(ctx, m.ID); err != nil {
+			return fmt.Errorf("failed to delete membership: %w", err)
 		}
 	}
 
-	// Delete the organization
+	// Soft-delete the organization
 	return uc.orgRepo.Delete(ctx, orgUUID)
 }
 

app/controlplane/pkg/data/data.go

@@ -144,7 +144,7 @@ func toTimePtr(t time.Time) *time.Time {
 }
 
 func orgScopedQuery(client *ent.Client, orgID uuid.UUID) *ent.OrganizationQuery {
-	return client.Organization.Query().Where(organization.ID(orgID))
+	return client.Organization.Query().Where(organization.ID(orgID), organization.DeletedAtIsNil())
 }
 
 // WithTx initiates a transaction and wraps the DB function

app/controlplane/pkg/data/ent/migrate/migrations/20250817154739.sql

@@ -0,0 +1,4 @@
+-- Modify "organizations" table
+ALTER TABLE "organizations" ADD COLUMN "deleted_at" timestamptz NULL;
+-- Create index "organization_name" to table: "organizations"
+CREATE UNIQUE INDEX "organization_name" ON "organizations" ("name") WHERE (deleted_at IS NULL);

app/controlplane/pkg/data/ent/migrate/migrations/20250817161454.sql

@@ -0,0 +1,2 @@
+-- Drop index "organizations_name_key" from table: "organizations"
+DROP INDEX "organizations_name_key";

app/controlplane/pkg/data/ent/migrate/migrations/atlas.sum

@@ -1,4 +1,4 @@
-h1:QaClWT8b1Nr8BRNI+5O2WAYbWl/5tTlopLggA6RQwzw=
+h1:RHLiR+aMRnWXumoeoZATujJDBqzz0vAwi1EJ/I7WPt4=
 20230706165452_init-schema.sql h1:VvqbNFEQnCvUVyj2iDYVQQxDM0+sSXqocpt/5H64k8M=
 20230710111950-cas-backend.sql h1:A8iBuSzZIEbdsv9ipBtscZQuaBp3V5/VMw7eZH6GX+g=
 20230712094107-cas-backends-workflow-runs.sql h1:a5rzxpVGyd56nLRSsKrmCFc9sebg65RWzLghKHh5xvI=
@@ -108,3 +108,5 @@ h1:QaClWT8b1Nr8BRNI+5O2WAYbWl/5tTlopLggA6RQwzw=
 20250808164400.sql h1:r7S2LM8d3kbKQ7WNuggjvmNw3kcccx0rYzzklw8Q2I8=
 20250808165202.sql h1:Oreh9FpYwo/cdcs3Oza/+ACzScXeTRBGIEvua8RqoLo=
 20250812111458.sql h1:15yQlZoBymYR5GEjGLtV/j4ZZjg06u6eEzcRRl7vax4=
+20250817154739.sql h1:myLtenqAYBq+qUmnB2loYATdXFRHMqTbPY3ZLhON4zE=
+20250817161454.sql h1:Fw6tM1GqCevnUUl7Za/hbQZr6wISKmsJy7OfX11ZMQI=

app/controlplane/pkg/data/ent/migrate/schema.go

@@ -413,9 +413,10 @@ var (
 	// OrganizationsColumns holds the columns for the "organizations" table.
 	OrganizationsColumns = []*schema.Column{
 		{Name: "id", Type: field.TypeUUID, Unique: true},
-		{Name: "name", Type: field.TypeString, Unique: true},
+		{Name: "name", Type: field.TypeString},
 		{Name: "created_at", Type: field.TypeTime, Default: "CURRENT_TIMESTAMP"},
 		{Name: "updated_at", Type: field.TypeTime, Default: "CURRENT_TIMESTAMP"},
+		{Name: "deleted_at", Type: field.TypeTime, Nullable: true},
 		{Name: "block_on_policy_violation", Type: field.TypeBool, Default: false},
 		{Name: "policies_allowed_hostnames", Type: field.TypeJSON, Nullable: true},
 	}
@@ -424,6 +425,16 @@ var (
 		Name:       "organizations",
 		Columns:    OrganizationsColumns,
 		PrimaryKey: []*schema.Column{OrganizationsColumns[0]},
+		Indexes: []*schema.Index{
+			{
+				Name:    "organization_name",
+				Unique:  true,
+				Columns: []*schema.Column{OrganizationsColumns[1]},
+				Annotation: &entsql.IndexAnnotation{
+					Where: "deleted_at IS NULL",
+				},
+			},
+		},
 	}
 	// ProjectsColumns holds the columns for the "projects" table.
 	ProjectsColumns = []*schema.Column{