Repository navigation
Conversation
…nt organization Bugfixes: - current_organization only uses the organization_id param for super admins; other roles without an organization get nil. - invite_user invites to current_organization instead of a form param (hidden field renamed to organization_id so super admins can still choose the organization). - resend_user_invitation only finds users of the current organization. - PartnerUsersController finds the partner within the current organization, and users within that partner, for every action (including reset_password). - AttachmentsController only deletes documents of the current organization's partners. Specs that relied on the old lookups now set up records in the signed-in user's organization. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UCzWYsxjKeDD9EVVp6L2eS
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bugfixes for lookups that weren't scoped to the current organization:
ApplicationController#current_organization: theorganization_idparam fallback is meant for super admins (whose role has no organization). It now applies only to super admins; partner-role users getnil, so bank screens redirect them to the partner dashboard.OrganizationsController#invite_user: invites tocurrent_organizationinstead of theorgform param. The modal's hidden field is renamedorg→organization_id, so super admins can still pick the organization.OrganizationsController#resend_user_invitation: only finds users of the current organization.PartnerUsersController:set_partnernow finds the partner within the current organization and runs for every action (it was skipped forreset_password).destroy,resend_invitationandreset_passwordfind the user within that partner.AttachmentsController#destroy: only deletesdocumentsof the current organization's partners, which is the only thing the UI uses it for. Anything else is a 404.Spec setup changes that came with this:
users_requests_spec(partner_user_reset_password): alet!(:user)was shadowing the signed-in bank user with a partner user. It's renamedpartner_user, so the spec signs in as a bank user as intended.partner_users_requests_specandattachments_requests_speccreated partners in a different organization from the signed-in user. They now use the user's organization.Not changed here (already broken before this PR): on the admin organization page, the reinvite/promote/remove buttons don't pass
organization_id, so they redirect super admins. Could be a follow-up.Type of change
How Has This Been Tested?
current_organizationcontroller specs. Against the old app code, 13 of them fail; with this change, all pass.rubocopis clean on changed files.🤖 Generated with Claude Code
https://claude.ai/code/session_01UCzWYsxjKeDD9EVVp6L2eS