raystack / frontier / 29984180803

46%

main: 47%

Pull #1792

github

fix(auth): reject PAT and service user when parent org is disabled

Disabling an org flipped its state but left credentials owned by that
org working. The PAT and service-user auth paths fetched the principal
without looking at the org state.

Each PAT and service-user authenticator now checks the parent org
through a new organization.IsEnabled. A disabled or missing org returns
403. The platform org (bootstrap superuser) is skipped so break-glass
credentials keep working.

Part of #1585.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

31 of 42 new or added lines in 5 files covered. (73.81%)

17841 of 38578 relevant lines covered (46.25%)

14.08 hits per line