Skip to content

6.2.2.13 OrganizationClosure

6.2.2.13.1 Purpose

Closes an Organization the way cloud providers delete a project: the request starts a grace period of 30 days during which the Organization is frozen but can still be restored, and at its end the closure runs once and cannot be undone. During the grace period members can still read and export their data; nothing else changes. When it runs, access revokes every role, group and delegation, the farm's credentials and clients are destroyed, its data is erased or anonymized, and every system cleans what it holds on the organization.closed event. A report records what was removed and what was kept and why, so the closure can be proved without the data.

6.2.2.13.2 Questions it answers

  • Is this Organization closing, since when, and when will the closure run?
  • Who asked for it, why, and can it still be cancelled?
  • What did each system remove or keep when the closure ran?

6.2.2.13.3 Fields

Field Type Cardinality Description
id string (uuid) 1..1 Key.
organization Organization 1..1
reason enum 1..1 Values: owner_request, staff_decision, never_approved.
owner_request: asked by the owner, who signs in again just before: the token's auth_time, the time of the last real sign-in, must be at most five minutes old; otherwise access answers reauthentication-required and the app asks the owner to sign in again.
staff_decision: by staff with access.organizations.close, e.g. a contract that ended or abuse; the Organization is told why, and only staff can cancel it. never_approved: a pending Organization that staff rejected, or that was not approved within 30 days; it holds no farm data, so it closes at once, with no grace period.
requested_by string 1..1 The User or MoonitoringUser who asked.
requested_at datetime 1..1
scheduled_for datetime 1..1 requested_at plus 30 days; equal to requested_at for never_approved. Moved later while a hold is set.
hold_until datetime 0..1 Staff can hold a closure, for a dispute or a request from an authority; it does not run before this date.
hold_reason string 0..1
cancelled_at datetime 0..1
cancelled_by string 0..1 The User or MoonitoringUser who restored the Organization; its status returns to the one it had before.
completed_at datetime 0..1
erasure_request ErasureRequest 0..1 For a Farm: the erasure executed when the closure ran.
previous_status enum 1..1 Values: pending, active, suspended.
The status of the Organization when the closure was requested; a cancellation restores it.
message string 0..1 Why staff closed it, as told to the Organization: shown in the app, sent by e-mail to the owner and carried by the event organization.closing; required for a staff_decision.
report_path string 0..1 What each system removed or kept and why, as JSON lines in the audit bucket: proof that the closure ran, without the data it removed.
created_at datetime 1..1
updated_at datetime 1..1

6.2.2.13.4 Relationships

References

6.2.2.13.5 Rules & constraints

  • Closing an Organization, modelled on how cloud providers delete a project: the request starts a grace period of 30 days during which the Organization is frozen and can still be restored; at its end the closure runs once, in a fixed order, and cannot be undone. Owned by access; every system cleans its own data on the events.
  • At most one closure per Organization that is neither cancelled nor completed; after a cancellation a new one can be requested.
  • During the grace period (status closing): members can sign in, read the Organization's data and export it, and nothing changes. Writes, new members and invitations, new delegations, sync runs and webhook or external deliveries are refused; schedules pause; entitlements are not consumed; delegations in both directions stop giving access; refresh tokens of its members are no longer renewed for it, so access ends within the lifetime of a token (fifteen minutes). access publishes organization.closing at the request and organization.closure_cancelled at a cancellation.
  • When the closure runs, its steps follow in this order; each is idempotent and recorded in the report.
    1. Access: every DirectMembership, DelegatedMembership, UserGroupMembership and UserGroupRoleAssignment of the Organization is revoked and its groups archived; every delegation where it is delegator or delegatee is revoked, with the memberships and group roles that came through it.
    1. Clients and connections: its ServiceAccounts are disabled and their credentials destroyed in the secret manager, its SyncClients retired, their installations revoked, its feeds closed, its schedules disabled, and its webhook subscriptions and external deliveries deleted.
    1. Entitlements end; FeatureUsage rows are kept only as long as billing and tax rules require (to confirm with the legal adviser), then deleted.
    1. Cooperative links: a Farm's link to its cooperative ends; a closing Cooperative unlinks its farms, which stay active and are told, and its CooperativeConstraints are removed.
    1. Farm data: the ErasureRequest of the farm runs and its raw files are deleted. Records of an animal whose ownership (Ownership) names another Organization that is not closed stay for that Organization, within what it may see; only what was the closed farm's alone is erased or anonymized.
    1. Product data: on organization.closed each system deletes or anonymizes what it keeps for the Organization: conversations, MooGrant research and documents, cached copies, ledgers beyond their legal retention.
    1. Kept, by rule: PlatformAuditEvent rows and the locked audit logs, OfficialSubmissions already sent (they belong to the official body), the anonymized structure of WriteCommits, and the Organization row as a tombstone whose name, contacts and fiscal identifier are removed, so the same farm can register again.
  • Backups and point-in-time recovery keep the data until they expire; a database restored after a closure re-runs the completed closures before it serves traffic.
  • The owner cannot leave an Organization while they are its owner: they transfer the ownership or close it. Users left with no Organization keep their account and profile (User).