fix: enforce active organization boundary

This commit is contained in:
2026-07-10 18:42:12 +08:00
parent f07f280b8f
commit d730e51c3d
24 changed files with 1686 additions and 460 deletions
@@ -7,6 +7,13 @@ import { join } from "node:path";
import Fastify from "fastify";
import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
import { registerAdminPlugin } from "../../src/admin/plugin.js";
import {
archiveFolder,
archiveProject,
moveOrgProjectToFolder,
renameFolder,
renameProject,
} from "../../src/org/explorer.js";
import {
mintSessionToken,
sessionCookieHeader,
@@ -221,4 +228,59 @@ describe("admin explorer API", () => {
await app.close();
}
});
it.each(["SUSPENDED", "ARCHIVED"] as const)(
"blocks direct explorer mutations when the organization is %s",
async (status) => {
await Promise.all([
prisma.folder.create({ data: { id: `folder-rename-${status}`, organizationId: DEFAULT_ORG_ID, name: "Rename" } }),
prisma.folder.create({ data: { id: `folder-archive-${status}`, organizationId: DEFAULT_ORG_ID, name: "Archive" } }),
prisma.folder.create({ data: { id: `folder-target-${status}`, organizationId: DEFAULT_ORG_ID, name: "Target" } }),
prisma.project.create({
data: { id: `project-rename-${status}`, organizationId: DEFAULT_ORG_ID, name: "Rename", workspaceDir: `/tmp/rename-${status}` },
}),
prisma.project.create({
data: { id: `project-archive-${status}`, organizationId: DEFAULT_ORG_ID, name: "Archive", workspaceDir: `/tmp/archive-${status}` },
}),
prisma.project.create({
data: { id: `project-move-${status}`, organizationId: DEFAULT_ORG_ID, name: "Move", workspaceDir: `/tmp/move-${status}` },
}),
]);
await prisma.organization.update({ where: { id: DEFAULT_ORG_ID }, data: { status } });
const expected = `organization ${DEFAULT_ORG_ID} is ${status}`;
await expect(renameFolder(prisma, {
organizationId: DEFAULT_ORG_ID,
folderId: `folder-rename-${status}`,
name: "Changed",
})).rejects.toThrow(expected);
await expect(archiveFolder(prisma, {
organizationId: DEFAULT_ORG_ID,
folderId: `folder-archive-${status}`,
})).rejects.toThrow(expected);
await expect(renameProject(prisma, {
organizationId: DEFAULT_ORG_ID,
projectId: `project-rename-${status}`,
name: "Changed",
})).rejects.toThrow(expected);
await expect(archiveProject(prisma, {
organizationId: DEFAULT_ORG_ID,
projectId: `project-archive-${status}`,
})).rejects.toThrow(expected);
await expect(moveOrgProjectToFolder(prisma, {
organizationId: DEFAULT_ORG_ID,
projectId: `project-move-${status}`,
folderId: `folder-target-${status}`,
})).rejects.toThrow(expected);
await expect(prisma.folder.findUniqueOrThrow({ where: { id: `folder-rename-${status}` } })).resolves.toMatchObject({
name: "Rename",
archivedAt: null,
});
await expect(prisma.project.findUniqueOrThrow({ where: { id: `project-rename-${status}` } })).resolves.toMatchObject({
name: "Rename",
archivedAt: null,
});
},
);
});