refactor(api): drop per-handler org-state checks covered by the gate

[AmanGIT07]

Summary

With the disabled-org gate on the authorization path (#1860), org-state enforcement now lives in one place. This removes the per-handler org-state checks that the gate makes redundant, so the gate is the single source of truth for org state.

Changes

• Group member RPCs (GetGroup, UpdateGroup, ListGroupUsers, RemoveGroupUser, SetGroupMemberRole, DisableGroup) and EnableGroup: drop the per-handler org-state check. getGroupInEnabledOrg becomes getGroup — it still loads the group and maps a disabled or missing group to NotFound, without checking org state.
• Domain DeleteOrganizationDomain, GetOrganizationDomain, VerifyOrganizationDomain and invitation GetOrganizationInvitation, DeleteOrganizationInvitation: remove the org-state pre-check. Domain ownership stays enforced in the interceptor.
• List RPCs ListOrganizationGroups, ListOrganizationDomains, ListOrganizationInvitations: resolve the org with GetRaw (state blind) to get its id; the gate enforces state.
• Create RPCs CreateGroup, CreateOrganizationDomain, CreateOrganizationInvitation: keep orgService.Get, so a disabled org blocks creation with FailedPrecondition.
• Move ensureOrgEnabled into org_state.go, alongside the gate and PAT checks that use it.
• Handler unit tests updated to match; org-state coverage lives with the gate.

Technical Details

• Disabled groups stay hidden by getGroup; the gate resolves groups with IncludeDisabled so re-enable still works.
• AuthToken and JoinOrganization keep their own org checks — they are on the authorization skip list, so the gate does not run for them.

Behavior changes

• On the domain RPCs, a non-member targeting a disabled org gets PermissionDenied (permission is checked first) rather than FailedPrecondition.
• Superusers can list groups, domains, and invitations of a disabled org. Creating resources in a disabled org stays blocked.

Test Plan

• make test passes
• make e2e-test passes
• Build and type checking passes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 10, 2026 1:03pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8665359e-e43c-48f7-9ede-26b99fb91fb6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Summary by CodeRabbit

• Behavior Changes
  • Domain, group, and invitation details can be retrieved or managed without requiring the associated organization to be enabled.
  • Group membership and role operations remain available when an organization is disabled.
  • Organization listings now distinguish missing organizations from other lookup errors.
  • Improved error handling provides clearer outcomes for missing organizations and unexpected service failures.

Walkthrough

Domain, group, and invitation handlers no longer enforce organization enabled-state checks for selected operations. Listing handlers use raw organization lookups. Tests now match the updated service interactions. A shared organization validation helper was added.

Changes

Organization state handler updates

Layer / File(s)	Summary
Shared organization validation helper internal/api/v1beta1connect/org_state.go	Added ensureOrgEnabled with mappings for disabled, missing, and unexpected organization-service errors.
Domain and invitation handler behavior internal/api/v1beta1connect/domain.go, internal/api/v1beta1connect/domain_test.go, internal/api/v1beta1connect/invitations.go, internal/api/v1beta1connect/invitations_test.go	Removed organization validation from direct domain and invitation operations. Listing operations now use GetRaw. Tests removed unused organization-service setup and expectations.
Group handler validation behavior internal/api/v1beta1connect/group.go, internal/api/v1beta1connect/group_test.go	Group operations now validate group state without checking the owning organization state. Group listing uses GetRaw. Tests retain group and membership error coverage without organization-state cases.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• raystack/frontier#1689: Overlaps in domain, group, and invitation handlers and organization-state error handling.
• raystack/frontier#1739: Modifies the same group handlers and organization-validation flow.
• raystack/frontier#1860: Modifies org_state.go and organization-state handling.

Suggested reviewers: rohilsurana, whoabhisheksah

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31390964691

Coverage increased (+0.2%) to 48.097%

Details

• Coverage increased (+0.2%) from the base build.
• Patch coverage: 4 uncovered changes across 3 files (21 of 25 lines covered, 84.0%).
• 419 coverage regressions across 13 files.

Uncovered Changes

File	Changed	Covered	%
internal/api/v1beta1connect/org_state.go	10	8	80.0%
internal/api/v1beta1connect/group.go	10	9	90.0%
internal/api/v1beta1connect/invitations.go	2	1	50.0%
Total (4 files)	25	21	84.0%

Coverage Regressions

419 previously-covered lines in 13 files lost coverage.

Top 10 Files by Coverage Loss	Lines Losing Coverage	Coverage
billing/checkout/service.go	114	10.21%
billing/subscription/service.go	105	42.28%
billing/plan/service.go	75	0.0%
internal/store/postgres/billing_plan_repository.go	45	7.58%
core/event/service.go	20	56.91%
pkg/server/connect_interceptors/authorization.go	17	0.0%
internal/api/v1beta1connect/billing_plan.go	16	93.44%
internal/api/v1beta1connect/group.go	8	78.53%
billing/plan/plan.go	6	68.42%
billing/entitlement/service.go	5	88.71%

---

Coverage Stats

Relevant Lines:	39919
Covered Lines:	19200
Line Coverage:	48.1%
Coverage Strength:	15.37 hits per line

---

💛 - Coveralls