[mikepitre]

What & why

• OrganizationMembership.delete() called ClerkApi.user.deleteMembership(organization.id) without a session id. UserApi.deleteMembership defaults _clerk_session_id to null, and UrlAppendingMiddleware only adds _is_native. As a result, DELETE /v1/me/organization_memberships/{organization_id} went out with no session id.
• fix(api): fix deletePassword and revokeSession, which threw on first call #997 fixed the same gap in SessionApi.revokeSession. There, emulator testing with two signed-in sessions showed the /me endpoint returning 401 authentication_invalid without _clerk_session_id, and 200 with it.
• Every other caller of the null-defaulted /me organization endpoints passes sessionId = currentSessionId(). delete() now does the same.
• OrganizationMembershipDeleteTest follows SessionRevokeTest from fix(api): fix deletePassword and revokeSession, which threw on first call #997. It runs delete() against a real Retrofit UserApi with two sessions on the client, and checks that the request URL carries the active session id. Before the fix it failed with expected:<sess_active> but was:<null>.

What to focus on

• This PR has not been checked on an emulator yet. To check it, leave an organization from the prebuilt UI while two sessions are signed in.
• This PR does not change UserApi.kt, so it does not conflict with fix(api): fix deletePassword and revokeSession, which threw on first call #997. The two can merge in either order.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Organization membership deletion requests now include the active session ID while continuing to target the selected membership within its organization. Deletions are therefore associated with the session currently in use, and the request is sent to the expected membership endpoint.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: clerk/clerk-android/.coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: eaa5431e-0139-4ffa-80a4-3eaa79ea1193

📥 Commits

Reviewing files that changed from the base of the PR and between 24c4fcc and f122839.

📒 Files selected for processing (1)

• source/api/src/test/java/com/clerk/api/organizations/OrganizationMembershipDeleteTest.kt

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

OrganizationMembership.delete() now passes the current session ID to the membership deletion API. A test checks that the request uses the membership’s organization ID and the active session ID.

Changes

Organization membership deletion

Layer / File(s)	Summary
Pass session context to membership deletion source/api/src/main/kotlin/com/clerk/api/organizations/OrganizationMembership.kt, source/api/src/test/java/com/clerk/api/organizations/OrganizationMembershipDeleteTest.kt	OrganizationMembership.delete() passes the current session ID to deleteMembership. The test checks the request path and _clerk_session_id query parameter. Test setup and helpers provide the mocked API and session fixtures.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to f1228

Membership deletion now includes session context, and the test verifies the request path and session parameter. No actionable risk preventing merge is established.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main fix: passing the active session ID when leaving an organization.
Description check	✅ Passed	The description explains the cause, behavior change, test coverage, emulator testing status, and reviewer focus. It omits the Screenshots / video section, but that omission is non-critical for this AP…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Starting review of this pull request. I'll look for new issues only and follow up with findings.

  

_{Sent by Cursor Automation: Multi Model Code Review}

[cursor]

Review

Two independent reviews (Grok 4.7 Extra High Fast and Muse Spark 1.3 Extra High) looked at sending the active session id from OrganizationMembership.delete().

Consensus: The production change is correct. UserApi.deleteMembership defaults _clerk_session_id to null, and UrlAppendingMiddleware only adds _is_native. Passing sessionId = currentSessionId() matches the other /me organization callers and is what stops the multi-session 401. Nothing previously filed on this PR was reopened. CodeRabbit’s docstring-coverage warning and the author’s note that this has not been emulator-tested were left as-is.

Risk: Low. This is one call site using the same session helper as the rest of the organization API. When there is no session, the query param stays absent, which is today’s behavior.

Merge: Yes. This can merge as is.

Approval: I would approve.

Findings

Consider (one reviewer, non-blocking): OrganizationMembershipDeleteTest checks the path and _clerk_session_id, and it does not check the HTTP method or that delete() succeeded. The stub body is {}. This endpoint’s success body is decoded as ClientPiggybackedResponse, which requires response, so {} does not decode and delete() returns a failure while the test still passes. The session-id assertion still holds, because the request is recorded before decoding and requests.single() fails if no request is sent. See the inline comment. I would not hold the PR for it.

Dismissed: Missing KDoc (already flagged by CodeRabbit). Emulator coverage (already called out by the author; this unit test covers the query param the bug is about).

No critical or warning issues should block merge.

  

_{Sent by Cursor Automation: Multi Model Code Review}

[swolfand]

One-line fix that matches the other /me organization callers, and the test fails without it. LGTM.