feat(data-access): allow a caller to delete their own grant on the organisation resource

Bojan Marjanovicrequested to merge
iam-99-authorize-delete-self-exception into main

Summary

  • dataaccess/internal/relationships/authz/authz.go introduces a new Authorizer.AuthorizeDelete method, distinct from AuthorizeWrite used by the create path, sharing a private authorize core
  • Allows a non-owner to delete their own grant on the organisation resource only when all batch objects are the organisation resource and all key subject identities match the caller's token identity (same origin/origin_id/local_id comparison used by ReadRelationships)
  • Defensive identity matching is verified inside the authorization logic, not relying on upstream validation
  • WriteRelationships remains unchanged — callers still cannot grant themselves roles on the organisation resource
  • Validation helper in dataaccess/update/delete_relationships.go was renamed and simplified; test doubles across the update package updated
  • docs/relationships-api.md updated to document the exception
  • No database schema or proto changes required — pure in-memory authorization logic

Closes #99 (closed). See gitlab-org/gitlab!250806 (comment 3763110409) for context.

Testing

  • Unit tests in authz_test.go verify the self-delete path does not access the database (empty fake DB convention)
  • Integration tests in authz_integration_test.go verify the exception bypasses grant/principal resolution
  • Integration tests in delete_relationships_integration_test.go cover end-to-end through DeleteRelationships against both Postgres and YugabyteDB
  • Scenarios covered: self-delete allowed for non-owner, deletion of another's grant still denied, organisation owner behavior unchanged, batch mixing organisation resource with other objects still denied even if self-targeted

🤖 Generated with Claude Code

Merge request reports