feat(store): org tokens search skips soft-deleted rows

[rohilsurana]

Last of the org view repositories. Same shape as #1939, #1943, #1945, #1946, #1947.

Summary

The org tokens search now skips soft-deleted transactions, billing accounts and organizations. A soft-deleted user no longer lends their name to a token.

Changes

• Start from fromLive(billing_transactions), add live(billing_customers).
• Join organizations and add live(organizations), like feat(store): project users search skips soft-deleted rows #1946 and feat(store): org service user credentials search skips soft-deleted rows #1949. The search is scoped by billing_customers.org_id, and a billing account is not soft-deleted when its org goes, so without this a soft-deleted org still listed its tokens.
• live(users) goes in the left join, not the where clause. The token stays, the deleted user's name and avatar come back empty. Dropping the row would change the totals an org sees.
• New docker-backed suite org_tokens_repository_pg_test.go. Updated expected SQL in org_tokens_repository_test.go.

Notes for review

• Nothing writes billing_transactions.deleted_at yet. The filter is here for when deleting an org becomes a soft delete and takes its transactions with it.
• First left join in this batch. The siblings all inner-join users and drop the row.
• user_id still comes back for a deleted user, only the name is gone.
• Out of scope: billing_transactions_repository.go reads the same table for the balance and the org's own list, with no filter. Once orgs are soft-deleted the two views will disagree. Tracked in CLD-3632.

Test Plan

• go test -run 'TestOrgTokensRepository' ./internal/store/postgres/ passes
• The new suite fails on main, naming the soft-deleted transaction, account, org and user
• golangci-lint run ./internal/store/postgres/... is clean
• No end to end run. Seeding real tokens needs billing set up with a provider.

SQL Safety

• Values flow through ? placeholders, goqu.Ex{}, or goqu.Record{} — never fmt.Sprintf or + building a query that gets executed.
• ToSQL() callers capture and forward params (query, params, err := stmt.ToSQL(); db.…Context(ctx, …, query, params...)). Never query, _, err := ….
• No ? placeholders inside single-quoted SQL literals in goqu.L.
• No new //nolint:forbidigo or // #nosec G20x annotations.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Sep 25, 2026 9:58am UTC

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: raystack/frontier/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: bdc73761-2d6d-4f82-9365-4fa3ecdfb1d7

📥 Commits

Reviewing files that changed from the base of the PR and between 1a8f1dd and 7bd0f5d.

📒 Files selected for processing (3)

• internal/store/postgres/org_tokens_repository.go
• internal/store/postgres/org_tokens_repository_pg_test.go
• internal/store/postgres/org_tokens_repository_test.go

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Organization token listings now exclude tokens associated with deleted billing transactions, billing accounts, or organizations.
  • Tokens without an associated user remain visible. Tokens linked to deleted users still appear with the user’s name hidden.
  • Token searches now return matches only from live records, avoiding results tied to deleted transactions, accounts, users, or organizations.

Walkthrough

The organization token query now excludes soft-deleted billing transactions, customers, organizations, and users. Updated SQL expectations and PostgreSQL integration tests cover the filtering behavior.

Changes

Organization token filtering

Layer / File(s)	Summary
Live-record query filters internal/store/postgres/org_tokens_repository.go, internal/store/postgres/org_tokens_repository_test.go	The base query filters soft-deleted billing transactions, customers, organizations, and users. SQL expectations cover the joins and filters across query variants.
PostgreSQL behavior tests internal/store/postgres/org_tokens_repository_pg_test.go	Integration tests check that deleted transactions and accounts are excluded, deleted organizations return no tokens, userless transactions remain listed, deleted users have hidden titles, and search excludes deleted records.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 7bd0f

No actionable merge-blocking risk is identified for the token-search change after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 7bd0f

The change narrows token visibility for deleted organizations and related records while preserving tokens whose user has been deleted. No newly exposed data path was identified. The remaining uncertainty is about surrounding access controls and future deletion behavior, not an observed flaw in this change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The effective change is limited to rows returned through the existing organization-token repository search, including its export consumer. The added predicates reduce visibility of soft-deleted records rather than expanding the requested organization scope.

Trust Boundaries and Controls

• observed — The repository enforces the supplied organization ID through billing_customers.org_id and applies live-record conditions before returning search results. The available evidence does not establish the authorization checks applied before that ID reaches the repository.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 36121381379

Coverage increased (+0.1%) to 52.211%

Details

• Coverage increased (+0.1%) from the base build.
• Patch coverage: 17 of 17 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	41166
Covered Lines:	21493
Line Coverage:	52.21%
Coverage Strength:	17.08 hits per line

---

💛 - Coveralls