fix: enforce active organization boundary

hub/src/org/teams.ts

@@ -5,6 +5,7 @@
  * grants that use this team as principal (product pin).
  */
 import type { Prisma, PrismaClient } from "@prisma/client";
+import { lockActiveOrganization } from "./status.js";
 
 export interface TeamRow {
   readonly id: string;
@@ -59,20 +60,21 @@ export async function createTeam(
 ): Promise<TeamRow> {
   const slug = sanitizeSlug(input.slug);
   const name = requireNonEmpty(input.name, "name");
-  const existing = await prisma.team.findFirst({
-    where: { organizationId: input.organizationId, slug, archivedAt: null },
-    select: { id: true },
-  });
-  if (existing !== null) {
-    throw new Error(`team slug already exists: ${slug}`);
-  }
-  const team = await prisma.team.create({
-    data: {
-      organizationId: input.organizationId,
-      slug,
-      name,
-      ...(input.description !== undefined ? { description: input.description } : {}),
-    },
+  const team = await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    const existing = await tx.team.findFirst({
+      where: { organizationId: input.organizationId, slug, archivedAt: null },
+      select: { id: true },
+    });
+    if (existing !== null) throw new Error(`team slug already exists: ${slug}`);
+    return tx.team.create({
+      data: {
+        organizationId: input.organizationId,
+        slug,
+        name,
+        ...(input.description !== undefined ? { description: input.description } : {}),
+      },
+    });
   });
   return {
     id: team.id,
@@ -93,21 +95,24 @@ export async function updateTeam(
     readonly description?: string | null | undefined;
   },
 ): Promise<TeamRow> {
-  const team = await requireActiveTeam(prisma, input.teamId, input.organizationId);
-  const updated = await prisma.team.update({
-    where: { id: team.id },
-    data: {
-      ...(input.name !== undefined ? { name: requireNonEmpty(input.name, "name") } : {}),
-      ...(input.description !== undefined ? { description: input.description } : {}),
-    },
-    select: {
-      id: true,
-      slug: true,
-      name: true,
-      description: true,
-      createdAt: true,
-      _count: { select: { memberships: { where: { revokedAt: null } } } },
-    },
+  const updated = await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    const team = await requireActiveTeam(tx, input.teamId, input.organizationId);
+    return tx.team.update({
+      where: { id: team.id },
+      data: {
+        ...(input.name !== undefined ? { name: requireNonEmpty(input.name, "name") } : {}),
+        ...(input.description !== undefined ? { description: input.description } : {}),
+      },
+      select: {
+        id: true,
+        slug: true,
+        name: true,
+        description: true,
+        createdAt: true,
+        _count: { select: { memberships: { where: { revokedAt: null } } } },
+      },
+    });
   });
   return {
     id: updated.id,
@@ -127,6 +132,7 @@ export async function archiveTeam(
   input: { readonly organizationId: string; readonly teamId: string },
 ): Promise<{ readonly archived: true; readonly teamId: string; readonly revokedGrants: number }> {
   return prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
     const team = await requireActiveTeam(tx, input.teamId, input.organizationId);
     const now = new Date();
     await tx.team.update({
@@ -183,34 +189,32 @@ export async function addTeamMember(
     readonly feishuOpenId?: string | undefined;
   },
 ): Promise<TeamMemberRow> {
-  const team = await requireActiveTeam(prisma, input.teamId, input.organizationId);
-  const user = await resolveUser(prisma, input);
-  // User should be an org member to join a team (product pin for pilot).
-  const membership = await prisma.organizationMembership.findFirst({
-    where: {
-      organizationId: input.organizationId,
-      userId: user.id,
-      revokedAt: null,
-    },
-    select: { id: true },
-  });
-  if (membership === null) {
-    throw new Error(`user ${user.id} is not an active member of the organization`);
-  }
-  const existing = await prisma.teamMembership.findFirst({
-    where: { teamId: team.id, userId: user.id, revokedAt: null },
-  });
-  if (existing !== null) {
-    throw new Error(`user ${user.id} is already on team ${team.id}`);
-  }
-  const row = await prisma.teamMembership.create({
-    data: { teamId: team.id, userId: user.id },
+  const result = await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    const team = await requireActiveTeam(tx, input.teamId, input.organizationId);
+    const user = await resolveUser(tx, input);
+    // User should be an org member to join a team (product pin for pilot).
+    const membership = await tx.organizationMembership.findFirst({
+      where: {
+        organizationId: input.organizationId,
+        userId: user.id,
+        revokedAt: null,
+      },
+      select: { id: true },
+    });
+    if (membership === null) throw new Error(`user ${user.id} is not an active member of the organization`);
+    const existing = await tx.teamMembership.findFirst({
+      where: { teamId: team.id, userId: user.id, revokedAt: null },
+    });
+    if (existing !== null) throw new Error(`user ${user.id} is already on team ${team.id}`);
+    const row = await tx.teamMembership.create({ data: { teamId: team.id, userId: user.id } });
+    return { user, row };
   });
   return {
-    userId: user.id,
-    feishuOpenId: user.feishuOpenId,
-    displayName: user.displayName,
-    createdAt: row.createdAt.toISOString(),
+    userId: result.user.id,
+    feishuOpenId: result.user.feishuOpenId,
+    displayName: result.user.displayName,
+    createdAt: result.row.createdAt.toISOString(),
   };
 }
 
@@ -222,23 +226,24 @@ export async function revokeTeamMember(
     readonly userId: string;
   },
 ): Promise<{ readonly revoked: true; readonly userId: string }> {
-  await requireActiveTeam(prisma, input.teamId, input.organizationId);
-  const membership = await prisma.teamMembership.findFirst({
-    where: { teamId: input.teamId, userId: input.userId, revokedAt: null },
-    select: { id: true },
-  });
-  if (membership === null) {
-    throw new Error(`team member not found: ${input.userId}`);
-  }
-  await prisma.teamMembership.update({
-    where: { id: membership.id },
-    data: { revokedAt: new Date() },
+  await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    await requireActiveTeam(tx, input.teamId, input.organizationId);
+    const membership = await tx.teamMembership.findFirst({
+      where: { teamId: input.teamId, userId: input.userId, revokedAt: null },
+      select: { id: true },
+    });
+    if (membership === null) throw new Error(`team member not found: ${input.userId}`);
+    await tx.teamMembership.update({
+      where: { id: membership.id },
+      data: { revokedAt: new Date() },
+    });
   });
   return { revoked: true as const, userId: input.userId };
 }
 
 async function resolveUser(
-  prisma: PrismaClient,
+  prisma: PrismaClient | Prisma.TransactionClient,
   input: { readonly userId?: string | undefined; readonly feishuOpenId?: string | undefined },
 ): Promise<{ readonly id: string; readonly feishuOpenId: string; readonly displayName: string }> {
   if (input.userId !== undefined && input.userId !== "") {