fix: enforce active organization boundary

hub/src/permission.ts

@@ -8,6 +8,7 @@
  */
 import type { PrismaClient } from "@prisma/client";
 import { createPermissionAuthorizer } from "./permissions/authorizer.js";
+import { inactiveOrganizationReason } from "./org/status.js";
 
 export { createPermissionAuthorizer, PrismaPermissionAuthorizer, roleGrantsEdit } from "./permissions/authorizer.js";
 export { PrismaPrincipalResolver, principalKey } from "./permissions/principals.js";
@@ -73,6 +74,13 @@ export async function canTriggerRole(
   principal: string,
 ): Promise<PermissionResult> {
   try {
+    const project = await prisma.project.findUnique({
+      where: { id: projectId },
+      select: { organization: { select: { id: true, status: true } } },
+    });
+    if (project === null) return { allowed: false, reason: `project not found: ${projectId}` };
+    const inactiveReason = inactiveOrganizationReason(project.organization.id, project.organization.status);
+    if (inactiveReason !== undefined) return { allowed: false, reason: inactiveReason };
     const anyGrant = await prisma.roleTriggerGrant.findFirst({
       where: { projectId, roleId },
       select: { id: true },