Audit and repair events whose course belongs to a different organization

[moveson]

Background

Courses were originally envisioned as having no organization owner; every course now has an organization_id. Under the old rubric an event could reasonably use any course, so some events may still point at a course owned by a different organization than their event group's.

One such relic surfaced on staging 2026-08-21: 2023-marathon-test-100k (event group 2023-marathon-test) uses a course from another organization, which caused a 500 on the event edit form (Scout error group 124190 on ost-staging; see #2234 for the mechanism — the form's course selector only offers the event group organization's courses, so it silently blanked course_id).

Audit

SQL:

select events.id,
       events.slug            as event_slug,
       event_groups.slug      as event_group_slug,
       eg_org.name            as event_group_organization,
       courses.slug           as course_slug,
       c_org.name             as course_organization
from events
  join event_groups on event_groups.id = events.event_group_id
  join organizations eg_org on eg_org.id = event_groups.organization_id
  join courses on courses.id = events.course_id
  join organizations c_org on c_org.id = courses.organization_id
where courses.organization_id != event_groups.organization_id
order by c_org.name, courses.slug, events.id;

Console equivalent:

Event.joins(:event_group, :course)
     .where("courses.organization_id != event_groups.organization_id")
     .includes(:course, event_group: :organization)
     .map { |e| [e.slug, e.event_group.organization.name, e.course.slug, e.course.organization.name] }

Run in both production and staging (staging has at least the one known case).

Remediation guidance

Per affected course, the right fix depends on who actually uses it:

• Course used only by one organization's events, but owned by another org: fix ownership — course.update(organization_id: <correct org>). No event changes needed.
• Course genuinely shared by events from multiple organizations: needs a decision — likely duplicate the course per organization and repoint the minority events. Two cautions when repointing events.course_id:
  • It fires Interactors::ChangeEventCourse (split remapping) — do it through the model, not update_column, and verify split times afterward.
  • Splitting a shared course changes split_ids, which is the pooling boundary for SplitTimeQuery.typical_segment_time and Projection.sql — moving events off a shared course removes their times from the original course's statistics. Usually desirable (see Simulate/duplicate test events share the production course and corrupt real events' statistics #2169), but worth knowing before the change.

Follow-up hardening (optional)

Once the data is clean, consider a validation that an event's course belongs to its event group's organization, so new relics cannot be created (API and imports included). Check DuplicateEventGroup in particular — if it can copy an event group to a different organization while reusing the source course, it would recreate this state (related: #2169's proposal to deep-copy courses when duplicating).

🤖 Generated with Claude Code

[moveson]

Audit results (2026-08-21)

Production: clean — zero cross-organization events. The relic exists only on staging, so the event-form 500 cannot occur in production data as it stands.

Staging: 8 events, two distinct patterns.

Pattern 1 — backwards course ownership (3 events). rufa-course is owned by Testrock, but its users are real Running Up For Air events (rufa-2016, rufa-2017, 2023-rufa). Fix is an ownership flip:

# First confirm no Testrock events also use the course (they would become
# new mismatches after the flip — they don't appear in the audit today
# because they currently match the course's Testrock ownership):
Course.friendly.find("rufa-course").events.includes(event_group: :organization)
      .map { |e| [e.slug, e.event_group.organization.name] }

Course.friendly.find("rufa-course").update!(organization: Organization.friendly.find("running-up-for-air"))

Pattern 2 — test events on real organizations' courses (5 events). Testrock groups riding production-shaped courses: testrock-100-2016 and test-suite-basic-2018 on hardrock-100-clockwise, 2023-marathon-test-100k and test-suite-multi-event-2018-100k on silverton-double-dirty-30, test-suite-location-grouped-2018-50m on quad-rock-50-2017-course. This is exactly the #2169 shape — their times pool into the real courses' statistics on staging. Options per event group: delete if obsolete test data, or repoint to a duplicated test-owned course (note repointing course_id through the model fires Interactors::ChangeEventCourse split remapping — verify split times afterward).

Given production is clean, the follow-up validation (course must belong to the event group's organization) can go in without a production data migration once staging is repaired.