fix: enforce active organization boundary

2026-07-10 18:42:12 +08:00
parent f07f280b8f
commit d730e51c3d
24 changed files with 1686 additions and 460 deletions
@@ -1,4 +1,5 @@
 import type { PermissionRole, Prisma, PrismaClient } from "@prisma/client";
+import { lockActiveOrganization } from "../org/status.js";

 export interface GrantTeamProjectAccessInput {
  readonly projectId: string;
@@ -30,6 +31,7 @@ export async function grantTeamProjectAccess(
 ): Promise<ProjectTeamAccessEntry> {
  return prisma.$transaction(async (tx) => {
    const { project, team } = await resolveProjectAndTeam(tx, input);
+    await lockActiveOrganization(tx, project.organizationId);
    const now = new Date();
    const existing = await tx.permissionGrant.findFirst({
      where: {
@@ -87,6 +89,7 @@ export async function revokeTeamProjectAccess(
 ): Promise<number> {
  return prisma.$transaction(async (tx) => {
    const { project, team } = await resolveProjectAndTeam(tx, input);
+    await lockActiveOrganization(tx, project.organizationId);
    const result = await tx.permissionGrant.updateMany({
      where: {
        resourceType: "PROJECT",