Clean up pre-existing direct user memberships on non-Group teams

[sonika-shah]

Data-cleanup follow-up to #32208 (API enforcement) and #32911 (team dropdowns).

Users may only be direct members of Group teams. That rule is now enforced on the API (#32208) and the UI team selector (#32911), but instances upgraded from before the rule can still have users attached directly to Department / Division / BusinessUnit teams. Those stale memberships are now invalid: the team's Add User action is hidden and editing such a user's teams fails validation, so there is no in-product way to remove them.

This adds a one-time data migration that removes those pre-existing direct memberships so the affected users fall back to Organization (the default team). Group teams and the special Organization root are left untouched.

---

Change

A 2.1.0 post-data migration (MySQL + Postgres) deletes the HAS relationships (relation = 10) between a user and any BusinessUnit / Division / Department team:

DELETE FROM entity_relationship er
USING team_entity te
WHERE er.fromId = te.id
  AND er.fromEntity = 'team'
  AND er.toEntity = 'user'
  AND er.relation = 10
  AND te.teamType IN ('BusinessUnit', 'Division', 'Department');

It is idempotent — a second run matches nothing.

---

Search index

Deleting the relationship updates the user's teams on read immediately, but the user's search document still lists the old team until it is reindexed. A standard post-upgrade users reindex refreshes Explore; no inline reindex is included here.

---

Testing

Validated on throwaway MySQL 8 and Postgres 15 against the real team_entity (generated teamType/id columns) and entity_relationship schema, with a seeded mix of memberships:

• deletes exactly the user memberships on Department / Division / BusinessUnit
• keeps Group and Organization user memberships
• keeps non-user rows on the same teams (e.g. team→role)
• re-running deletes 0 rows (idempotent)

---

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the CONTRIBUTING documentation.
• The migration is idempotent and covers both MySQL and PostgreSQL.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

One-time data migration that removes pre-existing direct user memberships from non-Group teams (Department, Division, BusinessUnit), cleaning up stale relationships created before API enforcement. The migration is idempotent, covers both MySQL and PostgreSQL, and has been validated against real schema with mixed membership types. No issues found.

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[github-actions]

✅ Playwright Results — workflow succeeded

Validated commit 959cf6adf18a280fb21ff6548787a84147a66676 in Playwright run 34448925309, attempt 1.

✅ 4487 passed · ❌ 0 failed · 🟡 7 flaky · ⏭️ 1 skipped · 🧰 0 lifecycle flaky

Performance

Blocking targets: ✅ met · Optimization targets: 🟡 in progress

Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting.

🕒 Full workflow signal wall (to summary) 1h 6m 13s

⏱️ Max setup 4m 19s · max shard execution 20m 25s · max shard-job elapsed before upload 23m 22s · reporting 20s

🌐 218.34 requests/attempt · 2.31 app boots/UI scenario · 35.27% common-shard skew

Optimization targets still in progress:

• Common shard skew was 35.27% (convergence target: at most 15%).
• Browser traffic was 218.34 requests per attempt (convergence target: fewer than 200).
• Application boot ratio was 2.31 per UI scenario (10956 boots / 4742 scenarios; convergence target: at most 1).

Shard	Passed	Failed	Flaky	Skipped	Lifecycle failed	Lifecycle flaky
✅ Shard advanced-search-01	130	0	0	0	0	0
✅ Shard chromium-01	152	0	0	0	0	0
✅ Shard chromium-02	160	0	0	0	0	0
✅ Shard chromium-03	127	0	0	0	0	0
✅ Shard chromium-04	122	0	0	0	0	0
✅ Shard chromium-05	151	0	0	0	0	0
🟡 Shard chromium-06	135	0	1	0	0	0
🟡 Shard chromium-07	144	0	1	0	0	0
✅ Shard chromium-08	165	0	0	0	0	0
🟡 Shard chromium-09	160	0	1	0	0	0
✅ Shard chromium-10	183	0	0	0	0	0
✅ Shard chromium-11	147	0	0	0	0	0
✅ Shard chromium-12	135	0	0	0	0	0
✅ Shard chromium-13	135	0	0	0	0	0
✅ Shard chromium-14	180	0	0	0	0	0
✅ Shard chromium-15	155	0	0	0	0	0
✅ Shard chromium-16	138	0	0	1	0	0
✅ Shard chromium-17	142	0	0	0	0	0
✅ Shard chromium-18	135	0	0	0	0	0
✅ Shard chromium-19	180	0	0	0	0	0
✅ Shard chromium-20	183	0	0	0	0	0
🟡 Shard chromium-21	160	0	2	0	0	0
🟡 Shard chromium-22	151	0	1	0	0	0
✅ Shard chromium-23	145	0	0	0	0	0
✅ Shard chromium-24	158	0	0	0	0	0
✅ Shard chromium-25	144	0	0	0	0	0
🟡 Shard chromium-26	150	0	1	0	0	0
✅ Shard data-asset-rules-01	65	0	0	0	0	0
✅ Shard domain-isolation-01	16	0	0	0	0	0
✅ Shard global-state-01	34	0	0	0	0	0
✅ Shard import-export-01	69	0	0	0	0	0
✅ Shard import-export-02	81	0	0	0	0	0
✅ Shard ingestion-01	33	0	0	0	0	0
✅ Shard ingestion-02	53	0	0	0	0	0
✅ Shard reindex-01	28	0	0	0	0	0
✅ Shard search-01	12	0	0	0	0	0
✅ Shard search-rbac-01	29	0	0	0	0	0

🟡 7 flaky test(s) (passed on retry)

• Pages/DataContractInheritance.spec.ts › Remove Asset - Inherited contract no longer shown when asset is removed from Data Product (shard chromium-06, 1 retry)
• Features/CustomizeDetailPage.spec.ts › customize navigation should work (shard chromium-07, 1 retry)
• Features/DataQuality/TestLibrary.spec.ts › should display pagination when test definitions exceed page size (shard chromium-09, 1 retry)
• Pages/EntityDataSteward.spec.ts › Tier Add, Update and Remove (shard chromium-21, 1 retry)
• Pages/ServiceEntity.spec.ts › Announcement create, edit & delete (shard chromium-21, 1 retry)
• Features/Glossary/GlossaryAdvancedOperations.spec.ts › should remove reviewer from term (shard chromium-22, 1 retry)
• Pages/TasksUIFlow.spec.ts › Create and resolve description task for Pipeline via UI (shard chromium-26, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace