fix: enforce active organization boundary

hub/src/org/members.ts

@@ -7,7 +7,8 @@
  * 3. Cannot revoke or demote the last remaining OWNER.
  * 4. ADMIN cannot modify OWNER memberships.
  */
-import type { OrganizationMemberRole, PrismaClient } from "@prisma/client";
+import type { OrganizationMemberRole, Prisma, PrismaClient } from "@prisma/client";
+import { lockActiveOrganization } from "./status.js";
 
 export interface OrgMemberRow {
   readonly userId: string;
@@ -56,32 +57,32 @@ export async function addOrgMember(
   const openId = requireNonEmpty(input.feishuOpenId, "feishuOpenId");
   assertCanAssignRole(input.actorRole, input.role, /* targetIsOwner */ false);
 
-  const user = await prisma.user.upsert({
-    where: { feishuOpenId: openId },
-    create: {
-      feishuOpenId: openId,
-      displayName: input.displayName?.trim() || openId,
-    },
-    update: {
-      ...(input.displayName !== undefined && input.displayName.trim() !== ""
-        ? { displayName: input.displayName.trim() }
-        : {}),
-    },
-  });
-
-  const existing = await prisma.organizationMembership.findFirst({
-    where: { organizationId: input.organizationId, userId: user.id, revokedAt: null },
-  });
-  if (existing !== null) {
-    throw new Error(`user ${user.id} is already an active member`);
-  }
-
-  const membership = await prisma.organizationMembership.create({
-    data: {
-      organizationId: input.organizationId,
-      userId: user.id,
-      role: input.role,
-    },
+  const { user, membership } = await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    const user = await tx.user.upsert({
+      where: { feishuOpenId: openId },
+      create: {
+        feishuOpenId: openId,
+        displayName: input.displayName?.trim() || openId,
+      },
+      update: {
+        ...(input.displayName !== undefined && input.displayName.trim() !== ""
+          ? { displayName: input.displayName.trim() }
+          : {}),
+      },
+    });
+    const existing = await tx.organizationMembership.findFirst({
+      where: { organizationId: input.organizationId, userId: user.id, revokedAt: null },
+    });
+    if (existing !== null) throw new Error(`user ${user.id} is already an active member`);
+    const membership = await tx.organizationMembership.create({
+      data: {
+        organizationId: input.organizationId,
+        userId: user.id,
+        role: input.role,
+      },
+    });
+    return { user, membership };
   });
 
   return {
@@ -104,46 +105,47 @@ export async function setOrgMemberRole(
     readonly role: OrganizationMemberRole;
   },
 ): Promise<OrgMemberRow> {
-  const membership = await prisma.organizationMembership.findFirst({
-    where: {
-      organizationId: input.organizationId,
-      userId: input.targetUserId,
-      revokedAt: null,
-    },
-    select: {
-      id: true,
-      role: true,
-      createdAt: true,
-      user: {
-        select: { id: true, feishuOpenId: true, displayName: true, avatarUrl: true },
+  return prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    const membership = await tx.organizationMembership.findFirst({
+      where: {
+        organizationId: input.organizationId,
+        userId: input.targetUserId,
+        revokedAt: null,
       },
-    },
+      select: {
+        id: true,
+        role: true,
+        createdAt: true,
+        user: {
+          select: { id: true, feishuOpenId: true, displayName: true, avatarUrl: true },
+        },
+      },
+    });
+    if (membership === null) throw new Error(`member not found: ${input.targetUserId}`);
+
+    assertCanAssignRole(input.actorRole, input.role, membership.role === "OWNER");
+    if (membership.role === "OWNER" && input.actorRole !== "OWNER") {
+      throw new Error("cannot modify OWNER membership as ADMIN");
+    }
+    if (membership.role === "OWNER" && input.role !== "OWNER") {
+      await assertNotLastOwner(tx, input.organizationId, input.targetUserId);
+    }
+
+    const updated = await tx.organizationMembership.update({
+      where: { id: membership.id },
+      data: { role: input.role },
+    });
+
+    return {
+      userId: membership.user.id,
+      feishuOpenId: membership.user.feishuOpenId,
+      displayName: membership.user.displayName,
+      avatarUrl: membership.user.avatarUrl,
+      role: updated.role,
+      createdAt: membership.createdAt.toISOString(),
+    };
   });
-  if (membership === null) {
-    throw new Error(`member not found: ${input.targetUserId}`);
-  }
-
-  assertCanAssignRole(input.actorRole, input.role, membership.role === "OWNER");
-  if (membership.role === "OWNER" && input.actorRole !== "OWNER") {
-    throw new Error("cannot modify OWNER membership as ADMIN");
-  }
-  if (membership.role === "OWNER" && input.role !== "OWNER") {
-    await assertNotLastOwner(prisma, input.organizationId, input.targetUserId);
-  }
-
-  const updated = await prisma.organizationMembership.update({
-    where: { id: membership.id },
-    data: { role: input.role },
-  });
-
-  return {
-    userId: membership.user.id,
-    feishuOpenId: membership.user.feishuOpenId,
-    displayName: membership.user.displayName,
-    avatarUrl: membership.user.avatarUrl,
-    role: updated.role,
-    createdAt: membership.createdAt.toISOString(),
-  };
 }
 
 export async function revokeOrgMember(
@@ -155,27 +157,27 @@ export async function revokeOrgMember(
     readonly targetUserId: string;
   },
 ): Promise<{ readonly revoked: true; readonly userId: string }> {
-  const membership = await prisma.organizationMembership.findFirst({
-    where: {
-      organizationId: input.organizationId,
-      userId: input.targetUserId,
-      revokedAt: null,
-    },
-    select: { id: true, role: true },
-  });
-  if (membership === null) {
-    throw new Error(`member not found: ${input.targetUserId}`);
-  }
-  if (membership.role === "OWNER" && input.actorRole !== "OWNER") {
-    throw new Error("cannot revoke OWNER membership as ADMIN");
-  }
-  if (membership.role === "OWNER") {
-    await assertNotLastOwner(prisma, input.organizationId, input.targetUserId);
-  }
-
-  await prisma.organizationMembership.update({
-    where: { id: membership.id },
-    data: { revokedAt: new Date() },
+  await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    const membership = await tx.organizationMembership.findFirst({
+      where: {
+        organizationId: input.organizationId,
+        userId: input.targetUserId,
+        revokedAt: null,
+      },
+      select: { id: true, role: true },
+    });
+    if (membership === null) throw new Error(`member not found: ${input.targetUserId}`);
+    if (membership.role === "OWNER" && input.actorRole !== "OWNER") {
+      throw new Error("cannot revoke OWNER membership as ADMIN");
+    }
+    if (membership.role === "OWNER") {
+      await assertNotLastOwner(tx, input.organizationId, input.targetUserId);
+    }
+    await tx.organizationMembership.update({
+      where: { id: membership.id },
+      data: { revokedAt: new Date() },
+    });
   });
   return { revoked: true as const, userId: input.targetUserId };
 }
@@ -194,7 +196,7 @@ function assertCanAssignRole(
 }
 
 async function assertNotLastOwner(
-  prisma: PrismaClient,
+  prisma: PrismaClient | Prisma.TransactionClient,
   organizationId: string,
   targetUserId: string,
 ): Promise<void> {