feat(mothership): erase private memory when a member leaves or an organization is deleted

Account deletion already queues the worker's memory cleanup. Removing a
member, removing an external collaborator from an organization's workspaces,
moving a member to another organization and deleting an organization now
queue it too, in the same transaction, with the worker's new
organization_member and organization targets.

Author: waleedlatif1

apps/sim/lib/billing/organizations/membership-external-removal.test.ts

@@ -1,23 +1,77 @@
 import { member } from '@sim/db/schema'
 import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
+import { resetEnvMock, setEnv } from '@sim/testing/mocks/env.mock'
 import {
   organizationMemberLimitsMock,
   organizationMemberLimitsMockFns,
 } from '@sim/testing/mocks/organization-member-limits.mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { outboxServiceMock, outboxServiceMockFns } from '@sim/testing/mocks/outbox-service.mock'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/billing/organizations/member-limits', () => organizationMemberLimitsMock)
+vi.mock('@/lib/core/outbox/service', () => outboxServiceMock)
 
 import {
   removeExternalUserFromOrganizationWorkspaces,
   removeUserFromOrganization,
 } from '@/lib/billing/organizations/membership'
+import { MEMORY_CLEANUP_EVENT } from '@/lib/mothership/memories/cleanup-event'
 
 const mockSetOrgMemberUsageLimit = organizationMemberLimitsMockFns.mockSetOrgMemberUsageLimit
+const { mockEnqueueOutboxEvents } = outboxServiceMockFns
+
+/** The private-memory erasure a removal queues for the departing user (D106 in Mothership). */
+function memberErasure(userId: string) {
+  return [
+    expect.anything(),
+    MEMORY_CLEANUP_EVENT,
+    [
+      expect.objectContaining({
+        request: {
+          version: 1,
+          target: { kind: 'organization_member', organizationId: 'org-1', userId },
+        },
+      }),
+    ],
+  ]
+}
 
 describe('external organization access removal', () => {
   beforeEach(() => {
     resetDbChainMock()
+    setEnv({ COPILOT_API_KEY: 'test-key' })
+  })
+
+  afterAll(() => {
+    resetEnvMock()
+  })
+
+  it("erases the departing user's private Mothership memory in the organization", async () => {
+    await removeExternalUserFromOrganizationWorkspaces({
+      organizationId: 'org-1',
+      userId: 'external-user',
+    })
+    expect(mockEnqueueOutboxEvents).toHaveBeenCalledWith(...memberErasure('external-user'))
+
+    queueTableRows(member, [{ id: 'membership', userId: 'target', role: 'member' }])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'membership' }])
+    await removeUserFromOrganization({
+      organizationId: 'org-1',
+      userId: 'target',
+      memberId: 'membership',
+      skipBillingLogic: true,
+      onError: 'throw',
+    })
+    expect(mockEnqueueOutboxEvents).toHaveBeenCalledWith(...memberErasure('target'))
+  })
+
+  it('erases nothing when a removal does not commit', async () => {
+    queueTableRows(member, [])
+    queueTableRows(member, [{ id: 'new-membership' }])
+    await expect(
+      removeExternalUserFromOrganizationWorkspaces({ organizationId: 'org-1', userId: 'external' })
+    ).rejects.toMatchObject({ code: 'conflict' })
+    expect(mockEnqueueOutboxEvents).not.toHaveBeenCalled()
   })
 
   it('clears a stale per-user organization usage cap in the removal transaction', async () => {

apps/sim/lib/billing/organizations/membership.ts

@@ -61,6 +61,7 @@ import { isRetryableTransactionError } from '@/lib/db/transaction'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
 import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
 import { type StoppedRun, stopLiveRunsTx } from '@/lib/mothership/async-runs/repository'
+import { enqueueMemoryCleanup } from '@/lib/mothership/memories/cleanup-outbox'
 import { requireMemberManagementAuthority } from '@/lib/organizations/members/authority'
 import {
   revokePersonalApiKeysTx,
@@ -1192,6 +1193,13 @@ export async function transferUserBetweenOrganizations(
         if (deleted.length === 0) {
           throw new Error('Member could not be transferred because their role changed')
         }
+        await enqueueMemoryCleanup(tx, [
+          {
+            kind: 'organization_member',
+            organizationId: params.sourceOrganizationId,
+            userId: params.userId,
+          },
+        ])
 
         const cancelledInvitations = invitationIds.length
           ? await tx
@@ -1407,6 +1415,7 @@ export async function removeUserFromOrganization(
             'The membership changed before removal. Refresh and try again.'
           )
         }
+        await enqueueMemoryCleanup(tx, [{ kind: 'organization_member', organizationId, userId }])
 
         if (!skipBillingLogic) {
           await enqueueOutboxEvent(tx, MEMBER_BILLING_RECONCILIATION_EVENT_TYPE, {
@@ -1679,6 +1688,7 @@ export async function removeExternalUserFromOrganizationWorkspaces(params: {
           )
 
         await setOrgMemberUsageLimit(organizationId, userId, null, undefined, tx)
+        await enqueueMemoryCleanup(tx, [{ kind: 'organization_member', organizationId, userId }])
 
         const cancelledInvitations = invitationIds.length
           ? await tx

apps/sim/lib/mothership/generated/memory-notes-access.ts

@@ -53,6 +53,14 @@ export const MemoryCleanupInput = z.strictObject({
     z.strictObject({ kind: z.literal("private_owner"), userId: z.string().min(1).max(200) }),
     z.strictObject({ kind: z.literal("workspace"), workspaceId: z.uuid() }),
     z.strictObject({ kind: z.literal("project"), projectId: z.uuid() }),
+    // Erase private memory held in an organization: all of it when the organization is
+    // deleted, one person's when they leave it (D106).
+    z.strictObject({ kind: z.literal("organization"), organizationId: z.string().min(1).max(200) }),
+    z.strictObject({
+      kind: z.literal("organization_member"),
+      organizationId: z.string().min(1).max(200),
+      userId: z.string().min(1).max(200),
+    }),
   ]),
 });
 export type MemoryCleanupInput = z.infer<typeof MemoryCleanupInput>;

apps/sim/lib/organizations/resource-cleanup.test.ts

@@ -12,6 +12,7 @@ vi.mock('@/lib/cleanup/chat-cleanup', () => chatCleanupMock)
 vi.mock('@/lib/core/outbox/service', () => outboxServiceMock)
 
 import type { OutboxEventContext } from '@/lib/core/outbox/service'
+import { MEMORY_CLEANUP_EVENT } from '@/lib/mothership/memories/cleanup-event'
 import {
   enqueueOrganizationResourceCleanup,
   organizationResourceCleanupOutboxHandlers,
@@ -20,7 +21,7 @@ import { ORGANIZATION_RESOURCE_CLEANUP_EVENT } from '@/lib/organizations/resourc
 
 const { mockDeleteFile } = storageServiceMockFns
 const { mockCleanupCopilotBackend } = chatCleanupMockFns
-const { mockEnqueueOutboxEvent } = outboxServiceMockFns
+const { mockEnqueueOutboxEvent, mockEnqueueOutboxEvents } = outboxServiceMockFns
 
 const ORG_ID = 'org-1'
 const CHAT_ID = '10000000-0000-4000-8000-000000000001'
@@ -60,6 +61,19 @@ afterAll(() => {
 })
 
 describe('enqueueOrganizationResourceCleanup', () => {
+  it("erases the organization's private Mothership memory in the delete transaction", async () => {
+    queueTableRows(organization, [{ id: ORG_ID }])
+
+    await db.transaction(async (tx) => {
+      await enqueueOrganizationResourceCleanup(tx, ORG_ID)
+      expect(mockEnqueueOutboxEvents).toHaveBeenCalledWith(tx, MEMORY_CLEANUP_EVENT, [
+        expect.objectContaining({
+          request: { version: 1, target: { kind: 'organization', organizationId: ORG_ID } },
+        }),
+      ])
+    })
+  })
+
   it('locks the organization and snapshots only canonical direct org resources inside the caller transaction', async () => {
     queueTableRows(organization, [{ id: ORG_ID }])
     queueTableRows(workspaceFiles, [

apps/sim/lib/organizations/resource-cleanup.ts

@@ -8,6 +8,7 @@ import { env } from '@/lib/core/config/env'
 import { enqueueOutboxEvent, type OutboxHandlerRegistry } from '@/lib/core/outbox/service'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import type { DbTransaction } from '@/lib/db/types'
+import { enqueueMemoryCleanup } from '@/lib/mothership/memories/cleanup-outbox'
 import { ORGANIZATION_RESOURCE_CLEANUP_EVENT } from '@/lib/organizations/resource-cleanup-event'
 import { deleteFile } from '@/lib/uploads/core/storage-service'
 
@@ -35,7 +36,8 @@ const organizationResourceCleanupSchema = z.discriminatedUnion('kind', [
  * Captures canonical bindings before the org FK cascade removes them. The org
  * row lock excludes new direct resources; a rebound resource is checked again
  * by the worker. Each keyset page becomes its own bounded outbox event in the
- * caller's delete transaction, so rollback cannot leave cleanup work behind.
+ * caller's delete transaction, so rollback cannot leave cleanup work behind. The
+ * members' private Mothership memory in the organization is erased the same way.
  */
 export async function enqueueOrganizationResourceCleanup(
   tx: DbTransaction,
@@ -105,6 +107,8 @@ export async function enqueueOrganizationResourceCleanup(
     chatCursor = chats[chats.length - 1].id
     if (chats.length < CLEANUP_BATCH_SIZE) break
   }
+
+  await enqueueMemoryCleanup(tx, [{ kind: 'organization', organizationId }])
 }
 
 export const organizationResourceCleanupOutboxHandlers = {