fix: enforce active organization boundary

2026-07-10 18:42:12 +08:00
parent f07f280b8f
commit d730e51c3d
24 changed files with 1686 additions and 460 deletions
@@ -68,4 +68,16 @@ describe("canTriggerRole (integration, per-role gate)", () => {
    const onP2 = await canTriggerRole(prisma, p2.id, "review", "ou_a");
    expect(onP2.allowed).toBe(false);
  });
+
+  it("denies an otherwise open role when the organization is suspended", async () => {
+    const project = await prisma.project.create({
+      data: { id: "p-role-suspended", organizationId: DEFAULT_ORG_ID, name: "T", workspaceDir: "/tmp/x" },
+    });
+    await prisma.organization.update({ where: { id: DEFAULT_ORG_ID }, data: { status: "SUSPENDED" } });
+
+    const result = await canTriggerRole(prisma, project.id, "draft", "ou_a");
+
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toContain(`organization ${DEFAULT_ORG_ID} is SUSPENDED`);
+  });
 });