Return conflict when user has linked records

Map remove-user foreign key failures to a dedicated IAM conflict error so\nconsole users no longer receive a generic internal server error when a\nprofile is still referenced by signed documents, tasks, assets, or\nother records.\n\nThe service now detects wrapped dependency errors across both profile\nand membership deletes, and resolvers explicitly map the new error type\nto conflict responses. Added unit tests cover dependency detection and\nthe user-facing error message.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/iam/organization_service.go

@@ -21,6 +21,7 @@ import (
 	"io"
 	"time"
 
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/crypto/uuid"
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/packages/emails"
@@ -354,10 +355,18 @@ func (s *OrganizationService) RemoveUser(
 			}
 
 			if err := profile.Delete(ctx, tx, scope, profileID); err != nil {
+				if isUserRemovalDependencyError(err) {
+					return NewUserReferencedByRecordsError(profileID)
+				}
+
 				return fmt.Errorf("cannot delete profile: %w", err)
 			}
 
 			if err := membership.Delete(ctx, tx, scope, membership.ID); err != nil {
+				if isUserRemovalDependencyError(err) {
+					return NewUserReferencedByRecordsError(profileID)
+				}
+
 				return fmt.Errorf("cannot delete membership: %w", err)
 			}
 
@@ -366,6 +375,19 @@ func (s *OrganizationService) RemoveUser(
 	)
 }
 
+func isUserRemovalDependencyError(err error) bool {
+	if errors.Is(err, coredata.ErrResourceInUse) {
+		return true
+	}
+
+	pgErr, ok := errors.AsType[*pgconn.PgError](err)
+	if !ok {
+		return false
+	}
+
+	return pgErr.Code == "23503"
+}
+
 func (s *OrganizationService) InviteUser(
 	ctx context.Context,
 	req *CreateInvitationRequest,