fix: enforce organization affiliation policy during role moves (CM-1132)

backend/src/api/public/v1/members/work-experiences/createMemberWorkExperience.ts

@@ -12,8 +12,8 @@ import { CommonMemberService } from '@crowd/common_services'
 import {
   MemberField,
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicy,
   cleanSoftDeletedMemberOrganization,
+  fetchManyOrganizationAffiliationPolicies,
   createMemberOrganization,
   fetchManyMemberOrgsWithOrgData,
   findMemberById,
@@ -92,12 +92,11 @@ export async function createMemberWorkExperience(req: Request, res: Response): P
           throw new ConflictError('A work experience with the same dates already exists')
         }
 
-        const isAffiliationBlocked = await checkOrganizationAffiliationPolicy(
-          tx,
+        const orgAffiliationPolicyById = await fetchManyOrganizationAffiliationPolicies(tx, [
           data.organizationId,
-        )
+        ])
 
-        if (newMemberOrgId && isAffiliationBlocked) {
+        if (newMemberOrgId && orgAffiliationPolicyById.get(data.organizationId)) {
           await changeMemberOrganizationAffiliationOverrides(tx, [
             {
               memberId,

backend/src/bin/scripts/backfill-email-domain-member-organization-dates.ts

@@ -3,8 +3,8 @@ import commandLineArgs from 'command-line-args'
 import { inferMemberOrganizationStintChanges } from '@crowd/common_services'
 import {
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicy,
   createMemberOrganization,
+  fetchManyOrganizationAffiliationPolicies,
   fetchEmailDomainMemberOrganizationActivityDates,
   fetchEmailDomainMemberOrganizationsWithoutDates,
   fetchMemberOrganizationsBySource,
@@ -115,12 +115,13 @@ setImmediate(async () => {
                         source: OrganizationSource.EMAIL_DOMAIN,
                       })
 
-                      const isAffiliationBlocked = await checkOrganizationAffiliationPolicy(
-                        tx,
-                        change.organizationId,
-                      )
+                      const orgAffiliationPolicyById =
+                        await fetchManyOrganizationAffiliationPolicies(tx, [change.organizationId])
 
-                      if (memberOrganizationId && isAffiliationBlocked) {
+                      if (
+                        memberOrganizationId &&
+                        orgAffiliationPolicyById.get(change.organizationId)
+                      ) {
                         await changeMemberOrganizationAffiliationOverrides(tx, [
                           {
                             memberId,

backend/src/services/member/memberOrganizationsService.ts

@@ -7,8 +7,8 @@ import { CommonMemberService } from '@crowd/common_services'
 import {
   OrganizationField,
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicy,
   cleanSoftDeletedMemberOrganization,
+  fetchManyOrganizationAffiliationPolicies,
   createMemberOrganization,
   deleteMemberOrganizations,
   fetchMemberOrganizationById,
@@ -182,11 +182,11 @@ export default class MemberOrganizationsService extends LoggerBase {
       // Create new member organization
       const newMemberOrgId = await createMemberOrganization(qx, memberId, memberOrgData)
 
-      // Check if organization affiliation is blocked
-      const isAffiliationBlocked = await checkOrganizationAffiliationPolicy(qx, data.organizationId)
+      const orgAffiliationPolicyById = await fetchManyOrganizationAffiliationPolicies(qx, [
+        data.organizationId,
+      ])
 
-      // If organization affiliation is blocked, create an affiliation override
-      if (newMemberOrgId && isAffiliationBlocked) {
+      if (newMemberOrgId && orgAffiliationPolicyById.get(data.organizationId)) {
         await changeMemberOrganizationAffiliationOverrides(qx, [
           {
             memberId,

backend/src/services/organizationService.ts

@@ -502,7 +502,7 @@ export default class OrganizationService extends LoggerBase {
       throw new Error409(this.options.language, 'merge.errors.multiple', mergeActions[0].state)
     }
 
-    let blockAffiliations = false
+    let orgAffiliationChanges = false
 
     try {
       const { original, toMerge } = await captureApiChange(
@@ -681,8 +681,15 @@ export default class OrganizationService extends LoggerBase {
             '[Merge Organizations] - Moving members to original organisation!',
           )
 
-          // update members that belong to source organization to destinati
-          await moveMembersBetweenOrganizations(optionsQx(repoOptions), toMergeId, originalId)
+          const { shouldRecalculateAffiliations } = await moveMembersBetweenOrganizations(
+            optionsQx(repoOptions),
+            toMergeId,
+            originalId,
+          )
+
+          if (shouldRecalculateAffiliations) {
+            orgAffiliationChanges = true
+          }
 
           this.log.info(
             { originalId, toMergeId },
@@ -712,21 +719,6 @@ export default class OrganizationService extends LoggerBase {
             '[Merge Organizations] - Including original organisation into secondary organisation segments done!',
           )
 
-          if (toUpdate.isAffiliationBlocked) {
-            this.log.info(
-              { originalId, toMergeId },
-              '[Merge Organizations] - Organization wide affiliation block detected!',
-            )
-
-            await applyOrganizationAffiliationPolicyToMembers(
-              optionsQx(repoOptions),
-              originalId,
-              false,
-            )
-
-            blockAffiliations = true
-          }
-
           await SequelizeRepository.commitTransaction(tx)
 
           this.log.info({ originalId, toMergeId }, '[Merge Organizations] - Transaction commited!')
@@ -756,7 +748,7 @@ export default class OrganizationService extends LoggerBase {
           toMergeId,
           original.displayName,
           toMerge.displayName,
-          blockAffiliations,
+          orgAffiliationChanges,
           this.options.currentUser.id,
         ],
       })

services/apps/cron_service/src/jobs/inferMemberOrganizationStintChanges.job.ts

@@ -8,9 +8,9 @@ import {
 import {
   QueryExecutor,
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicy,
   createMemberOrganization,
   deleteUndatedMemberOrganizations,
+  fetchManyOrganizationAffiliationPolicies,
   fetchMemberOrganizationsBySource,
   updateMemberOrganization,
 } from '@crowd/data-access-layer'
@@ -116,12 +116,11 @@ async function applyStintChanges(qx: QueryExecutor, changes: MemberOrgStintChang
         source: OrganizationSource.EMAIL_DOMAIN,
       })
 
-      const isAffiliationBlocked = await checkOrganizationAffiliationPolicy(
-        qx,
+      const orgAffiliationPolicies = await fetchManyOrganizationAffiliationPolicies(qx, [
         change.organizationId,
-      )
+      ])
 
-      if (memberOrganizationId && isAffiliationBlocked) {
+      if (memberOrganizationId && orgAffiliationPolicies.get(change.organizationId)) {
         await changeMemberOrganizationAffiliationOverrides(qx, [
           {
             memberId: change.memberId,

services/apps/data_sink_worker/src/service/organization.service.ts

@@ -1,6 +1,6 @@
 import {
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicies,
+  fetchManyOrganizationAffiliationPolicies,
 } from '@crowd/data-access-layer'
 import { DbStore } from '@crowd/data-access-layer/src/database'
 import {
@@ -54,17 +54,19 @@ export class OrganizationService extends LoggerBase {
 
     const newMemberOrgs = await addOrgsToMember(qe, memberId, orgs)
 
-    const blockedOrgIds = await checkOrganizationAffiliationPolicies(
+    const orgAffiliationPolicies = await fetchManyOrganizationAffiliationPolicies(
       qe,
       newMemberOrgs.map((mo) => mo.organizationId),
     )
+
     const overrides = newMemberOrgs
-      .filter((mo) => blockedOrgIds.has(mo.organizationId))
+      .filter((mo) => orgAffiliationPolicies.get(mo.organizationId))
       .map((mo) => ({
         memberId,
         memberOrganizationId: mo.memberOrganizationId,
         allowAffiliation: false,
       }))
+
     if (overrides.length > 0) {
       await changeMemberOrganizationAffiliationOverrides(qe, overrides)
     }

services/apps/entity_merging_worker/src/workflows/all.ts

@@ -99,15 +99,15 @@ export async function finishOrganizationMerging(
   secondaryId: string,
   original: string,
   toMerge: string,
-  blockAffiliation: boolean,
+  shouldRecalculateAffiliations: boolean,
   userId: string,
 ): Promise<void> {
   await setMergeAction(primaryId, secondaryId, {
     step: MergeActionStep.MERGE_ASYNC_STARTED,
   })
   await finishOrganizationMergingUpdateActivities(secondaryId, primaryId)
 
-  if (blockAffiliation) {
+  if (shouldRecalculateAffiliations) {
     await recalculateActivityAffiliationsOfOrganizationAsync(primaryId)
   }
 

services/apps/members_enrichment_worker/src/activities/enrichment.ts

@@ -12,7 +12,7 @@ import {
 import { CommonMemberService } from '@crowd/common_services'
 import {
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicy,
+  fetchManyOrganizationAffiliationPolicies,
   updateMemberAttributes,
   updateMemberContributions,
   updateMemberReach,
@@ -636,21 +636,21 @@ export async function updateMemberUsingSquashedPayload(
         }
       }
 
-      for (const mo of newOrUpdatedMemberOrgs) {
-        const isOrganizationAffiliationBlocked = await checkOrganizationAffiliationPolicy(
-          qx,
-          mo.organizationId,
-        )
+      const orgAffiliationPolicies = await fetchManyOrganizationAffiliationPolicies(
+        qx,
+        newOrUpdatedMemberOrgs.map((mo) => mo.organizationId),
+      )
 
-        if (isOrganizationAffiliationBlocked) {
-          await changeMemberOrganizationAffiliationOverrides(qx, [
-            {
-              memberId,
-              memberOrganizationId: mo.id,
-              allowAffiliation: false,
-            },
-          ])
-        }
+      const overrides = newOrUpdatedMemberOrgs
+        .filter((mo) => orgAffiliationPolicies.get(mo.organizationId))
+        .map((mo) => ({
+          memberId,
+          memberOrganizationId: mo.id,
+          allowAffiliation: false,
+        }))
+
+      if (overrides.length > 0) {
+        await changeMemberOrganizationAffiliationOverrides(qx, overrides)
       }
     }
 

services/libs/common_services/src/services/common.member.service.ts

@@ -23,10 +23,10 @@ import {
   MemberField,
   QueryExecutor,
   changeMemberOrganizationAffiliationOverrides,
-  checkOrganizationAffiliationPolicy,
   createOrUpdateMemberOrganizations,
   deleteMemberOrganizations,
   fetchManyMemberOrgsWithOrgData,
+  fetchManyOrganizationAffiliationPolicies,
   fetchMemberOrganizations,
   findAllUnkownDatedOrganizations,
   findIdentitiesForMembers,
@@ -146,9 +146,12 @@ export class CommonMemberService extends LoggerBase {
               dates.dateEnd as string | null,
             )
 
-            const isAffiliationBlocked = await checkOrganizationAffiliationPolicy(this.qx, org.id)
+            const orgAffiliationPolicyById = await fetchManyOrganizationAffiliationPolicies(
+              this.qx,
+              [org.id],
+            )
 
-            if (newMemberOrgId && isAffiliationBlocked) {
+            if (newMemberOrgId && orgAffiliationPolicyById.get(org.id)) {
               await changeMemberOrganizationAffiliationOverrides(this.qx, [
                 {
                   memberId,

services/libs/common_services/src/services/member/unmerge.ts

@@ -8,10 +8,12 @@ import {
   MemberField,
   QueryExecutor,
   addMemberRole,
+  changeMemberOrganizationAffiliationOverrides,
   createMember,
   createMemberIdentity,
   deleteManyMemberIdentities,
   fetchManyMemberOrgsWithOrgData,
+  fetchManyOrganizationAffiliationPolicies,
   fetchMemberIdentities,
   findAlreadyExistingVerifiedIdentities,
   findMemberById,
@@ -529,10 +531,31 @@ export async function unmergeMember(
       secondary.memberOrganizations.map((o) => o.organizationId),
     )
 
-    for (const role of secondary.memberOrganizations.filter(
+    const rolesToRestore = secondary.memberOrganizations.filter(
       (r) => !nonExistingOrgIds.includes(r.organizationId),
-    )) {
-      await addMemberRole(tx, { ...role, memberId: secondaryId })
+    )
+    const orgAffiliationPolicies = await fetchManyOrganizationAffiliationPolicies(
+      tx,
+      Array.from(new Set(rolesToRestore.map((r) => r.organizationId))),
+    )
+
+    for (const role of rolesToRestore) {
+      const newRoleId = await addMemberRole(tx, { ...role, memberId: secondaryId })
+      if (newRoleId) {
+        const isBlocked = orgAffiliationPolicies.get(role.organizationId) ?? false
+        // Only org-level policy blocks are restored here. Pre-merge manual row-level
+        // blocks and isPrimaryWorkExperience flags are not restored because the unmerge
+        // backup does not carry override data.
+        if (isBlocked) {
+          await changeMemberOrganizationAffiliationOverrides(tx, [
+            {
+              memberId: secondaryId,
+              memberOrganizationId: newRoleId,
+              allowAffiliation: false,
+            },
+          ])
+        }
+      }
     }
 
     // Delete stale roles from primary that aren't in the preview