fix(membership): Removing a user from the org should cleanup resources

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

app/controlplane/cmd/wire_gen.go

@@ -47,6 +47,8 @@ type GroupRepo interface {
 	AddMemberToGroup(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID, maintainer bool) (*GroupMembership, error)
 	// RemoveMemberFromGroup removes a user from a group.
 	RemoveMemberFromGroup(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID) error
+	// RemoveMemberFromAllGroups removes a user from all groups in the organization.
+	RemoveMemberFromAllGroups(ctx context.Context, orgID uuid.UUID, userID uuid.UUID) error
 	// UpdateMemberMaintainerStatus updates the maintainer status of a group member.
 	UpdateMemberMaintainerStatus(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID, isMaintainer bool) error
 	// ListPendingInvitationsByGroup retrieves a list of pending invitations for a group

app/controlplane/pkg/biz/group.go

@@ -57,6 +57,7 @@ type MembershipRepo interface {
 	// RBAC methods
 
 	ListAllByUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
+	ListDirectMembershipsByUserInOrg(ctx context.Context, orgID uuid.UUID, userID uuid.UUID) ([]*Membership, error)
 	// ListGroupMembershipsByUser returns all memberships of the users inherited from groups
 	ListGroupMembershipsByUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
 	ListAllByResource(ctx context.Context, rt authz.ResourceType, id uuid.UUID) ([]*Membership, error)
@@ -69,13 +70,14 @@ type MembershipsRBAC interface {
 
 type MembershipUseCase struct {
 	repo       MembershipRepo
+	groupReo   GroupRepo
 	orgUseCase *OrganizationUseCase
 	logger     *log.Helper
 	auditor    *AuditorUseCase
 }
 
-func NewMembershipUseCase(repo MembershipRepo, orgUC *OrganizationUseCase, auditor *AuditorUseCase, logger log.Logger) *MembershipUseCase {
-	return &MembershipUseCase{repo: repo, orgUseCase: orgUC, logger: log.NewHelper(logger), auditor: auditor}
+func NewMembershipUseCase(repo MembershipRepo, orgUC *OrganizationUseCase, auditor *AuditorUseCase, groupRepo GroupRepo, logger log.Logger) *MembershipUseCase {
+	return &MembershipUseCase{repo: repo, orgUseCase: orgUC, logger: log.NewHelper(logger), auditor: auditor, groupReo: groupRepo}
 }
 
 // LeaveAndDeleteOrg deletes a membership (and the org i) from the database associated with the current user
@@ -99,9 +101,23 @@ func (uc *MembershipUseCase) LeaveAndDeleteOrg(ctx context.Context, userID, memb
 		return NewErrNotFound("membership")
 	}
 
-	uc.logger.Infow("msg", "Deleting membership", "user_id", userID, "membership_id", m.ID.String())
-	if err := uc.repo.Delete(ctx, membershipUUID); err != nil {
-		return fmt.Errorf("failed to delete membership: %w", err)
+	// Get all direct memberships for the user in the org in regard to resources
+	resourceMemberships, err := uc.repo.ListDirectMembershipsByUserInOrg(ctx, m.OrganizationID, userUUID)
+	if err != nil {
+		return fmt.Errorf("failed to find direct memberships in org: %w", err)
+	}
+
+	for _, rm := range resourceMemberships {
+		uc.logger.Infow("msg", "Deleting membership", "user_id", userID, "membership_id", rm.ID.String())
+
+		if err := uc.repo.Delete(ctx, rm.ID); err != nil {
+			return fmt.Errorf("failed to delete membership: %w", err)
+		}
+	}
+
+	// Remove the user from all groups in the org
+	if err := uc.groupReo.RemoveMemberFromAllGroups(ctx, m.OrganizationID, userUUID); err != nil {
+		return fmt.Errorf("failed to remove user from all groups in org: %w", err)
 	}
 
 	uc.auditor.Dispatch(ctx, &events.OrgUserLeft{
@@ -142,22 +158,59 @@ func (uc *MembershipUseCase) DeleteOther(ctx context.Context, orgID, userID, mem
 		return NewErrInvalidUUID(err)
 	}
 
+	// Find the membership to delete
 	m, err := uc.repo.FindByIDInOrg(ctx, orgUUID, membershipUUID)
 	if err != nil {
 		return fmt.Errorf("failed to find membership: %w", err)
 	} else if m == nil {
 		return NewErrNotFound("membership")
 	}
 
+	// Prevent users from deleting their own membership
 	if m.User.ID == userID {
 		return NewErrValidationStr("cannot delete yourself from the org")
 	}
 
+	// Parse the user ID of the membership to be removed
+	toRemoveUserUUID, err := uuid.Parse(m.User.ID)
+	if err != nil {
+		return NewErrInvalidUUID(err)
+	}
+
+	// Log the deletion
 	uc.logger.Infow("msg", "Deleting membership", "org_id", orgID, "membership_id", m.ID.String())
+
+	// Delete the main membership
 	if err := uc.repo.Delete(ctx, membershipUUID); err != nil {
 		return fmt.Errorf("failed to delete membership: %w", err)
 	}
 
+	// Clean up all resource-related memberships
+	if err := uc.deleteRelatedMemberships(ctx, m.OrganizationID, toRemoveUserUUID); err != nil {
+		return err
+	}
+
+	// Remove the user from all groups in the org
+	if err := uc.groupReo.RemoveMemberFromAllGroups(ctx, m.OrganizationID, toRemoveUserUUID); err != nil {
+		return fmt.Errorf("failed to remove user from all groups in org: %w", err)
+	}
+
+	return nil
+}
+
+// deleteRelatedMemberships removes all resource-related memberships for a user in an organization
+func (uc *MembershipUseCase) deleteRelatedMemberships(ctx context.Context, orgID, userID uuid.UUID) error {
+	resourceMemberships, err := uc.repo.ListDirectMembershipsByUserInOrg(ctx, orgID, userID)
+	if err != nil {
+		return fmt.Errorf("failed to find direct memberships in org: %w", err)
+	}
+
+	for _, rm := range resourceMemberships {
+		if err := uc.repo.Delete(ctx, rm.ID); err != nil {
+			return fmt.Errorf("failed to delete membership: %w", err)
+		}
+	}
+
 	return nil
 }
 

app/controlplane/pkg/biz/membership.go

@@ -475,6 +475,59 @@ func (g GroupRepo) RemoveMemberFromGroup(ctx context.Context, orgID uuid.UUID, g
 	return nil
 }
 
+// RemoveMemberFromAllGroups removes a user from all groups in an organization.
+func (g GroupRepo) RemoveMemberFromAllGroups(ctx context.Context, orgID uuid.UUID, userID uuid.UUID) error {
+	return WithTx(ctx, g.data.DB, func(tx *ent.Tx) error {
+		// Find all group memberships for the user in the organization
+		memberships, err := tx.GroupMembership.Query().
+			Where(
+				groupmembership.UserIDEQ(userID),
+				groupmembership.DeletedAtIsNil(),
+				groupmembership.HasGroupWith(group.OrganizationIDEQ(orgID)),
+			).
+			All(ctx)
+		if err != nil {
+			return fmt.Errorf("failed to query group memberships: %w", err)
+		}
+
+		if len(memberships) == 0 {
+			return nil // No memberships to remove
+		}
+
+		now := time.Now()
+
+		for _, mem := range memberships {
+			// Soft delete each membership
+			if _, err := tx.GroupMembership.UpdateOne(mem).
+				SetDeletedAt(now).
+				SetUpdatedAt(now).
+				Save(ctx); err != nil {
+				return fmt.Errorf("failed to remove user from group: %w", err)
+			}
+
+			if mem.Maintainer {
+				// Also remove the user membership if it exists
+				if _, err := tx.Membership.Delete().Where(
+					membership.MemberID(userID),
+					membership.ResourceTypeEQ(authz.ResourceTypeGroup),
+					membership.HasOrganizationWith(organization.ID(orgID)),
+				).Exec(ctx); err != nil {
+					return fmt.Errorf("failed to remove user from group: %w", err)
+				}
+			}
+
+			// Decrement the member count of the group
+			if err := tx.Group.UpdateOneID(mem.GroupID).
+				AddMemberCount(-1).
+				Exec(ctx); err != nil {
+				return fmt.Errorf("failed to decrement group member count: %w", err)
+			}
+		}
+
+		return nil
+	})
+}
+
 // UpdateMemberMaintainerStatus updates the maintainer status of a group member.
 func (g GroupRepo) UpdateMemberMaintainerStatus(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID, isMaintainer bool) error {
 	return WithTx(ctx, g.data.DB, func(tx *ent.Tx) error {

app/controlplane/pkg/biz/testhelpers/wire_gen.go

@@ -259,6 +259,23 @@ func (r *MembershipRepo) ListAllByUser(ctx context.Context, userID uuid.UUID) ([
 	return entMembershipsToBiz(mm), nil
 }
 
+// ListDirectMembershipsByUserInOrg returns all memberships of the user in a given organization
+func (r *MembershipRepo) ListDirectMembershipsByUserInOrg(ctx context.Context, orgID uuid.UUID, userID uuid.UUID) ([]*biz.Membership, error) {
+	mm, err := r.data.DB.Membership.Query().Where(
+		membership.MembershipTypeEQ(authz.MembershipTypeUser),
+		membership.MemberID(userID),
+		membership.HasOrganizationWith(
+			organization.ID(orgID),
+		),
+	).WithOrganization().All(ctx)
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to query memberships: %w", err)
+	}
+
+	return entMembershipsToBiz(mm), nil
+}
+
 // ListGroupMembershipsByUser returns all memberships of the users inherited from groups
 func (r *MembershipRepo) ListGroupMembershipsByUser(ctx context.Context, userID uuid.UUID) ([]*biz.Membership, error) {
 	// First query all group memberships for the user directly