Delete old unused role memberships

Author: ChrisPenner

sql/2025-09-22_org_membership_roles.sql

@@ -1,4 +1,4 @@
--- Org membership is now associated with a specific role within the org, this simplifies things, 
+-- Org membership is now associated with a specific role within the org, this simplifies things,
 -- makes the data more consistent,  no need to rely on triggers, and makes it much easier to display in the UI.
 
 -- Update the role permissions, some roles had an incorrect 'org:create_project' rather than 'project:create' permission
@@ -22,7 +22,7 @@ ALTER TABLE org_members
     ADD COLUMN role_id UUID REFERENCES roles(id) NULL;
 
 -- set all existing org members to be maintiners
-UPDATE org_members 
+UPDATE org_members
   SET role_id = (SELECT id FROM roles WHERE ref = 'org_maintainer' LIMIT 1);
 
 -- Elevate the current org owners to have the org_owner role
@@ -59,7 +59,7 @@ $$ LANGUAGE plpgsql;
 
 CREATE TRIGGER check_org_owners_trigger
     AFTER UPDATE OR DELETE ON org_members
-    FOR EACH ROW 
+    FOR EACH ROW
     EXECUTE FUNCTION check_orgs_have_an_owner();
 
 -- Split out view containing all the direct subject<->resource permissions.
@@ -88,7 +88,7 @@ CREATE OR REPLACE VIEW direct_resource_permissions(subject_id, resource_id, perm
 
 -- This view builds on top of direct_resource_permissions to include inherited permissions
 CREATE OR REPLACE VIEW subject_resource_permissions(subject_id, resource_id, permission) AS (
-  SELECT drp.subject_id, drp.resource_id, drp.permission 
+  SELECT drp.subject_id, drp.resource_id, drp.permission
     FROM direct_resource_permissions drp
   UNION
   -- Inherit permissions from parent resources
@@ -98,4 +98,8 @@ CREATE OR REPLACE VIEW subject_resource_permissions(subject_id, resource_id, per
 );
 
 
--- TODO: delete now redundant roles from role_memberships
+DELETE FROM role_memberships rm
+  USING roles r
+  WHERE
+    rm.role_id = r.id
+    AND r.ref::text IN ('org_viewer', 'org_maintainer', 'org_contributor', 'org_admin', 'org_owner', 'org_default');