test: fix integration tests for new organization leave/delete behavior

- Update user integration test to expect account deletion to be blocked when user is sole owner
- Update membership integration test to expect no cleanup when sole owner cannot leave
- Update copyright headers to 2024-2025 for modified test files
- Set proper owner roles in test setup to trigger validation logic

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/controlplane/pkg/biz/membership_integration_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -419,7 +419,7 @@ func (s *membershipIntegrationTestSuite) TestDeleteWithGroups() {
 	orgUUID := uuid.MustParse(org.ID)
 
 	// Add user to organization
-	membershipUser, err := s.Membership.Create(ctx, org.ID, user.ID, biz.WithMembershipRole(authz.RoleAdmin), biz.WithCurrentMembership())
+	membershipUser, err := s.Membership.Create(ctx, org.ID, user.ID, biz.WithMembershipRole(authz.RoleOwner), biz.WithCurrentMembership())
 	s.NoError(err)
 
 	// Create multiple groups with the user as maintainer
@@ -480,25 +480,25 @@ func (s *membershipIntegrationTestSuite) TestDeleteWithGroups() {
 		_, err = s.Organization.FindByID(ctx, org.ID)
 		s.NoError(err)
 
-		// Groups should still exist since user couldn't leave
+		// Groups should still exist since user couldn't leave (no cleanup happened)
 		_, err = s.Group.Get(ctx, orgUUID, &biz.IdentityReference{ID: &group1.ID})
 		s.NoError(err, "Group 1 should still exist")
 
 		_, err = s.Group.Get(ctx, orgUUID, &biz.IdentityReference{ID: &group2.ID})
-		s.True(biz.IsNotFound(err), "Group 2 should be deleted")
+		s.NoError(err, "Group 2 should still exist since user couldn't leave")
 
-		// The project should be deleted
+		// The project should still exist since no cleanup happened
 		_, err = s.Project.FindProjectByReference(ctx, org.ID, &biz.IdentityReference{ID: projectRef.ID})
-		s.True(biz.IsNotFound(err), "Project should be deleted")
+		s.NoError(err, "Project should still exist since user couldn't leave")
 
-		// Verify group memberships are marked as deleted
+		// Verify group memberships still exist since user couldn't leave
 		group1Mem, group1Err := s.Repos.GroupRepo.FindGroupMembershipByGroupAndID(ctx, group1.ID, userUUID)
-		s.True(biz.IsNotFound(group1Err))
-		s.Nil(group1Mem)
+		s.NoError(group1Err)
+		s.NotNil(group1Mem)
 
 		group2Mem, group2Err := s.Repos.GroupRepo.FindGroupMembershipByGroupAndID(ctx, group2.ID, userUUID)
-		s.True(biz.IsNotFound(group2Err))
-		s.Nil(group2Mem)
+		s.NoError(group2Err)
+		s.NotNil(group2Mem)
 	})
 }
 

app/controlplane/pkg/biz/user_integration_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -80,28 +80,30 @@ User mapping:
 func (s *userIntegrationTestSuite) TestDeleteUser() {
 	ctx := context.Background()
 
+	// User deletion should be blocked because userOne is sole owner of userOneOrg
 	err := s.User.DeleteUser(ctx, s.userOne.ID)
-	s.NoError(err)
+	s.Error(err)
+	s.True(biz.IsErrValidation(err))
+	s.Contains(err.Error(), "sole owner")
 
-	// Organization where the user is the only member got deleted
+	// Both organizations should still exist since deletion was blocked
 	gotOrgOne, err := s.Organization.FindByID(ctx, s.userOneOrg.ID)
-	s.Error(err)
-	s.True(biz.IsNotFound(err))
-	s.Nil(gotOrgOne)
+	s.NoError(err)
+	s.NotNil(gotOrgOne)
 
-	// Organization that it's shared with another user is still present
 	gotSharedOrg, err := s.Organization.FindByID(ctx, s.sharedOrg.ID)
 	s.NoError(err)
 	s.NotNil(gotSharedOrg)
 
-	// user and associated memberships have been deleted
+	// User should still exist since deletion was blocked
 	gotUser, err := s.User.FindByID(ctx, s.userOne.ID)
 	s.NoError(err)
-	s.Nil(gotUser)
+	s.NotNil(gotUser)
 
+	// Memberships should still exist since deletion was blocked
 	gotMembership, err := s.Membership.ByUser(ctx, s.userOne.ID)
 	s.NoError(err)
-	s.Empty(gotMembership)
+	s.NotEmpty(gotMembership)
 }
 
 func (s *userIntegrationTestSuite) TestCurrentMembership() {
@@ -224,15 +226,15 @@ func (s *userIntegrationTestSuite) SetupTest() {
 	// Create User 1
 	s.userOne, err = s.User.UpsertByEmail(ctx, "user-1@test.com", nil)
 	assert.NoError(err)
-	// Attach both orgs
-	_, err = s.Membership.Create(ctx, s.userOneOrg.ID, s.userOne.ID)
+	// Attach both orgs - make user owner of userOneOrg and owner of sharedOrg  
+	_, err = s.Membership.Create(ctx, s.userOneOrg.ID, s.userOne.ID, biz.WithMembershipRole(authz.RoleOwner))
 	assert.NoError(err)
-	_, err = s.Membership.Create(ctx, s.sharedOrg.ID, s.userOne.ID, biz.WithCurrentMembership())
+	_, err = s.Membership.Create(ctx, s.sharedOrg.ID, s.userOne.ID, biz.WithMembershipRole(authz.RoleOwner), biz.WithCurrentMembership())
 	assert.NoError(err)
 
-	// Create User 2 and attach shared org
+	// Create User 2 and attach shared org as owner too
 	s.userTwo, err = s.User.UpsertByEmail(ctx, "user-2@test.com", nil)
 	assert.NoError(err)
-	_, err = s.Membership.Create(ctx, s.sharedOrg.ID, s.userTwo.ID, biz.WithCurrentMembership())
+	_, err = s.Membership.Create(ctx, s.sharedOrg.ID, s.userTwo.ID, biz.WithMembershipRole(authz.RoleOwner), biz.WithCurrentMembership())
 	assert.NoError(err)
 }