feat: auto-join scoped Feishu OAuth users

hub/test/integration/admin-auth.test.ts

@@ -267,9 +267,6 @@ describe("admin auth + org API guards", () => {
       openId: "ou_scoped_user",
       displayName: "Invited User",
     });
-    await prisma.organizationMembership.create({
-      data: { organizationId: DEFAULT_ORG_ID, userId: identity.userId, role: "ADMIN" },
-    });
     await seedTestOrganization("org_scoped_other", "scoped-other");
     await prisma.organizationMembership.create({
       data: { organizationId: "org_scoped_other", userId: identity.userId, role: "ADMIN" },
@@ -317,7 +314,7 @@ describe("admin auth + org API guards", () => {
       expect(me.statusCode).toBe(200);
       expect(me.json()).toMatchObject({
         user: { id: identity.userId, displayName: "Scoped User" },
-        organizations: [expect.objectContaining({ slug: "test-default", role: "ADMIN" })],
+        organizations: [expect.objectContaining({ slug: "test-default", role: "MEMBER" })],
       });
       expect((me.json() as { organizations: unknown[] }).organizations).toHaveLength(1);
       const crossOrganization = await app.inject({
@@ -331,6 +328,13 @@ describe("admin auth + org API guards", () => {
         where: { id: identity.identityId },
         select: { unionId: true },
       })).resolves.toEqual({ unionId: "on_scoped_union" });
+      await expect(prisma.auditEntry.count({
+        where: {
+          organizationId: DEFAULT_ORG_ID,
+          actorUserId: identity.userId,
+          action: "organization_member.oauth_auto_joined",
+        },
+      })).resolves.toBe(1);
 
       await connections.disable({ organizationId: DEFAULT_ORG_ID, actorUserId: "scoped-owner" });
       const revoked = await app.inject({ method: "GET", url: "/api/me", headers: { cookie: sessionCookie } });
@@ -340,6 +344,65 @@ describe("admin auth + org API guards", () => {
     }
   });
 
+  it("does not restore a revoked Organization membership during scoped OAuth", async () => {
+    await seedUser("revoked-owner", "legacy_revoked_owner", "OWNER");
+    const connections = new FeishuApplicationConnectionService(prisma, testSecretEnvelope, async () => {});
+    const connection = await connections.rotateCustomerApplication({
+      organizationId: DEFAULT_ORG_ID,
+      actorUserId: "revoked-owner",
+      appId: "cli_revoked_oauth",
+      appSecret: "revoked-oauth-secret",
+      botOpenId: "ou_revoked_bot",
+    });
+    const identity = await upsertScopedFeishuIdentity(prisma, {
+      connectionId: connection.id,
+      openId: "ou_revoked_user",
+      displayName: "Revoked User",
+    });
+    await prisma.organizationMembership.create({
+      data: {
+        organizationId: DEFAULT_ORG_ID,
+        userId: identity.userId,
+        role: "MEMBER",
+        revokedAt: new Date(),
+      },
+    });
+    const fetchImpl = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("/oauth/token")) {
+        return Response.json({ code: 0, access_token: "revoked-user-token" });
+      }
+      if (url.includes("/user_info")) {
+        return Response.json({
+          code: 0,
+          data: { open_id: "ou_revoked_user", name: "Revoked User" },
+        });
+      }
+      throw new Error(`unexpected ${url}`);
+    });
+    const app = await buildApp(fetchImpl as unknown as typeof fetch);
+    try {
+      const start = await app.inject({ method: "GET", url: "/auth/feishu/test-default" });
+      const authorize = new URL(String(start.headers.location));
+      const state = authorize.searchParams.get("state");
+      expect(state).not.toBeNull();
+      const callback = await app.inject({
+        method: "GET",
+        url: `/auth/feishu/callback?code=ok&state=${encodeURIComponent(state!)}`,
+        headers: { cookie: cookiePair(start.headers["set-cookie"], OAUTH_STATE_COOKIE_NAME) },
+      });
+      expect(callback.statusCode).toBe(302);
+      await expect(prisma.organizationMembership.count({
+        where: { organizationId: DEFAULT_ORG_ID, userId: identity.userId, revokedAt: null },
+      })).resolves.toBe(0);
+      await expect(prisma.auditEntry.count({
+        where: { action: "organization_member.oauth_auto_joined", actorUserId: identity.userId },
+      })).resolves.toBe(0);
+    } finally {
+      await app.close();
+    }
+  });
+
   it("unknown org slug returns 404 for admin", async () => {
     await seedUser("u-admin", "ou_admin", "ADMIN");
     const app = await buildApp();