fix(deleter): cascade service user delete on organization delete

.mockery.yaml

@@ -87,3 +87,7 @@ packages:
     config:
       dir: "core/event/mocks"
       all: true
+  github.com/raystack/frontier/core/deleter:
+    config:
+      dir: "core/deleter/mocks"
+      all: true

cmd/serve.go

@@ -561,8 +561,8 @@ func buildAPIDependencies(
 	)
 
 	cascadeDeleter := deleter.NewCascadeDeleter(organizationService, projectService, resourceService,
-		groupService, policyService, roleService, invitationService, userService, customerService,
-		subscriptionService, invoiceService,
+		groupService, policyService, roleService, invitationService, userService, serviceUserService,
+		customerService, subscriptionService, invoiceService,
 	)
 
 	// we should default it with a stdout logger repository as postgres can start to bloat really fast

core/deleter/service.go

@@ -28,6 +28,7 @@ import (
 
 	"github.com/raystack/frontier/core/project"
 	"github.com/raystack/frontier/core/resource"
+	"github.com/raystack/frontier/core/serviceuser"
 )
 
 const (
@@ -77,6 +78,11 @@ type UserService interface {
 	Delete(ctx context.Context, id string) error
 }
 
+type ServiceUserService interface {
+	List(ctx context.Context, flt serviceuser.Filter) ([]serviceuser.ServiceUser, error)
+	Delete(ctx context.Context, id string) error
+}
+
 type CustomerService interface {
 	Delete(ctx context.Context, id string) error
 	List(ctx context.Context, filter customer.Filter) ([]customer.Customer, error)
@@ -92,37 +98,40 @@ type InvoiceService interface {
 }
 
 type Service struct {
-	projService       ProjectService
-	orgService        OrganizationService
-	resService        ResourceService
-	groupService      GroupService
-	policyService     PolicyService
-	roleService       RoleService
-	invitationService InvitationService
-	userService       UserService
-	customerService   CustomerService
-	subService        SubscriptionService
-	invoiceService    InvoiceService
+	projService        ProjectService
+	orgService         OrganizationService
+	resService         ResourceService
+	groupService       GroupService
+	policyService      PolicyService
+	roleService        RoleService
+	invitationService  InvitationService
+	userService        UserService
+	serviceUserService ServiceUserService
+	customerService    CustomerService
+	subService         SubscriptionService
+	invoiceService     InvoiceService
 }
 
 func NewCascadeDeleter(orgService OrganizationService, projService ProjectService,
 	resService ResourceService, groupService GroupService,
 	policyService PolicyService, roleService RoleService,
 	invitationService InvitationService, userService UserService,
+	serviceUserService ServiceUserService,
 	customerService CustomerService, subService SubscriptionService,
 	invoiceService InvoiceService) *Service {
 	return &Service{
-		projService:       projService,
-		orgService:        orgService,
-		resService:        resService,
-		groupService:      groupService,
-		policyService:     policyService,
-		roleService:       roleService,
-		invitationService: invitationService,
-		userService:       userService,
-		customerService:   customerService,
-		subService:        subService,
-		invoiceService:    invoiceService,
+		projService:        projService,
+		orgService:         orgService,
+		resService:         resService,
+		groupService:       groupService,
+		policyService:      policyService,
+		roleService:        roleService,
+		invitationService:  invitationService,
+		userService:        userService,
+		serviceUserService: serviceUserService,
+		customerService:    customerService,
+		subService:         subService,
+		invoiceService:     invoiceService,
 	}
 }
 
@@ -199,6 +208,17 @@ func (d Service) DeleteOrganization(ctx context.Context, id string) error {
 		}
 	}
 
+	// delete all service users (clears credentials, org membership, and SpiceDB tuples)
+	serviceUsers, err := d.serviceUserService.List(ctx, serviceuser.Filter{OrgID: id})
+	if err != nil {
+		return err
+	}
+	for _, su := range serviceUsers {
+		if err = d.serviceUserService.Delete(ctx, su.ID); err != nil {
+			return fmt.Errorf("failed to delete org while deleting a service user[%s]: %w", su.ID, err)
+		}
+	}
+
 	// delete all roles
 	roles, err := d.roleService.List(ctx, role.Filter{
 		OrgID: id,