fix: enforce active organization boundary

hub/src/permissions/externalSync.ts

@@ -1,4 +1,5 @@
-import type { PrismaClient, PrincipalType } from "@prisma/client";
+import type { Prisma, PrismaClient, PrincipalType } from "@prisma/client";
+import { lockActiveOrganization } from "../org/status.js";
 
 export type ExternalPrincipalType = Extract<
   PrincipalType,
@@ -33,98 +34,112 @@ export async function syncExternalPrincipalMemberships(
   const syncedAt = new Date();
   const incomingKeys = new Set<string>();
   let synced = 0;
-  const connection = await prisma.externalDirectoryConnection.upsert({
-    where: {
-      organizationId_provider_source: {
+  const connection = await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    return tx.externalDirectoryConnection.upsert({
+      where: {
+        organizationId_provider_source: {
+          organizationId: input.organizationId,
+          provider: input.provider ?? "FEISHU",
+          source: input.source,
+        },
+      },
+      update: {
+        revokedAt: null,
+        ...(input.providerTenantId !== undefined ? { providerTenantId: input.providerTenantId } : {}),
+      },
+      create: {
         organizationId: input.organizationId,
         provider: input.provider ?? "FEISHU",
+        ...(input.providerTenantId !== undefined ? { providerTenantId: input.providerTenantId } : {}),
         source: input.source,
       },
-    },
-    update: {
-      revokedAt: null,
-      ...(input.providerTenantId !== undefined ? { providerTenantId: input.providerTenantId } : {}),
-    },
-    create: {
-      organizationId: input.organizationId,
-      provider: input.provider ?? "FEISHU",
-      ...(input.providerTenantId !== undefined ? { providerTenantId: input.providerTenantId } : {}),
-      source: input.source,
-    },
-    select: { id: true },
-  });
-
-  for (const item of input.memberships) {
-    assertExternalPrincipalType(item.principalType);
-    const user = await prisma.user.upsert({
-      where: { feishuOpenId: item.feishuOpenId },
-      update: { displayName: item.displayName },
-      create: {
-        feishuOpenId: item.feishuOpenId,
-        displayName: item.displayName,
-        platformRoles: { create: { role: "TEACHER" } },
-        organizationMemberships: { create: { organizationId: input.organizationId, role: "MEMBER" } },
-      },
-    });
-    await ensureOrganizationMembership(prisma, input.organizationId, user.id);
-    incomingKeys.add(externalMembershipKey(user.id, item.principalType, item.principalId, connection.id));
-    const existing = await prisma.externalPrincipalMembership.findFirst({
-      where: {
-        userId: user.id,
-        principalType: item.principalType,
-        principalId: item.principalId,
-        connectionId: connection.id,
-        revokedAt: null,
-      },
       select: { id: true },
     });
-    if (existing === null) {
-      await prisma.externalPrincipalMembership.create({
-        data: {
-          userId: user.id,
-          connectionId: connection.id,
-          principalType: item.principalType,
-          principalId: item.principalId,
-          syncedAt,
+  });
+
+  // Each membership is a short lifecycle-serialized unit. A large directory
+  // must not hold the Organization row lock (or one interactive transaction)
+  // for the duration of the entire external sync.
+  for (const item of input.memberships) {
+    assertExternalPrincipalType(item.principalType);
+    const userId = await prisma.$transaction(async (tx) => {
+      await lockActiveOrganization(tx, input.organizationId);
+      const user = await tx.user.upsert({
+        where: { feishuOpenId: item.feishuOpenId },
+        update: { displayName: item.displayName },
+        create: {
+          feishuOpenId: item.feishuOpenId,
+          displayName: item.displayName,
+          platformRoles: { create: { role: "TEACHER" } },
+          organizationMemberships: { create: { organizationId: input.organizationId, role: "MEMBER" } },
         },
       });
-    } else {
-      await prisma.externalPrincipalMembership.update({
-        where: { id: existing.id },
-        data: { syncedAt },
+      await ensureOrganizationMembership(tx, input.organizationId, user.id);
+      const existing = await tx.externalPrincipalMembership.findFirst({
+        where: {
+          userId: user.id,
+          principalType: item.principalType,
+          principalId: item.principalId,
+          connectionId: connection.id,
+          revokedAt: null,
+        },
+        select: { id: true },
       });
-    }
+      if (existing === null) {
+        await tx.externalPrincipalMembership.create({
+          data: {
+            userId: user.id,
+            connectionId: connection.id,
+            principalType: item.principalType,
+            principalId: item.principalId,
+            syncedAt,
+          },
+        });
+      } else {
+        await tx.externalPrincipalMembership.update({
+          where: { id: existing.id },
+          data: { syncedAt },
+        });
+      }
+      return user.id;
+    });
+    incomingKeys.add(externalMembershipKey(userId, item.principalType, item.principalId, connection.id));
     synced++;
   }
 
   let revoked = 0;
   if (input.replaceSource === true) {
-    const active = await prisma.externalPrincipalMembership.findMany({
-      where: { connectionId: connection.id, revokedAt: null },
-      select: { id: true, userId: true, principalType: true, principalId: true, connectionId: true },
-    });
-    const revokeIds = active
-      .filter((membership) => !incomingKeys.has(externalMembershipKey(
-        membership.userId,
-        membership.principalType,
-        membership.principalId,
-        membership.connectionId,
-      )))
-      .map((membership) => membership.id);
-    if (revokeIds.length > 0) {
-      const result = await prisma.externalPrincipalMembership.updateMany({
-        where: { id: { in: revokeIds } },
-        data: { revokedAt: syncedAt },
+    revoked = await prisma.$transaction(async (tx) => {
+      await lockActiveOrganization(tx, input.organizationId);
+      const active = await tx.externalPrincipalMembership.findMany({
+        where: { connectionId: connection.id, revokedAt: null },
+        select: { id: true, userId: true, principalType: true, principalId: true, connectionId: true },
       });
-      revoked = result.count;
-    }
+      const revokeIds = active
+        .filter((membership) => !incomingKeys.has(externalMembershipKey(
+          membership.userId,
+          membership.principalType,
+          membership.principalId,
+          membership.connectionId,
+        )))
+        .map((membership) => membership.id);
+      if (revokeIds.length > 0) {
+        const result = await tx.externalPrincipalMembership.updateMany({
+          where: { id: { in: revokeIds } },
+          data: { revokedAt: syncedAt },
+        });
+        return result.count;
+      }
+      return 0;
+    });
   }
 
   return { synced, revoked };
 }
 
 async function ensureOrganizationMembership(
-  prisma: PrismaClient,
+  prisma: PrismaClient | Prisma.TransactionClient,
   organizationId: string,
   userId: string,
 ): Promise<void> {