feat(authz): enforce disabled org state on the authorization path

.mockery.yaml

@@ -95,3 +95,7 @@ packages:
     config:
       dir: "core/serviceuser/mocks"
       all: true
+  github.com/raystack/frontier/core/resource:
+    config:
+      dir: "core/resource/mocks"
+      all: true

core/resource/service.go

@@ -38,6 +38,7 @@ type ProjectService interface {
 
 type OrgService interface {
 	Get(ctx context.Context, idOrName string) (organization.Organization, error)
+	GetRaw(ctx context.Context, idOrName string) (organization.Organization, error)
 }
 
 type PATService interface {
@@ -282,8 +283,11 @@ func (s Service) buildRelationObject(ctx context.Context, obj relation.Object) (
 				obj.ID = project.ID
 			}
 			if obj.Namespace == schema.OrganizationNamespace {
-				// if object is org, then fetch org by name
-				org, err := s.orgService.Get(ctx, obj.ID)
+				// if object is org, then fetch org by name. The lookup is
+				// state blind on purpose: the permission check must run
+				// before org state matters, so a disabled org resolves here
+				// and the authorization layer decides the outcome
+				org, err := s.orgService.GetRaw(ctx, obj.ID)
 				if err != nil {
 					return obj, err
 				}

internal/api/v1beta1connect/authorize.go

@@ -51,12 +51,10 @@ func (h *ConnectHandler) IsAuthorized(ctx context.Context, object relation.Objec
 			"subject_id", currentUser.ID)
 		return handleAuthErr(err)
 	}
-	if result {
-		return nil
-	}
+	allowed := result
 
 	// for invitation, we need to check if the user is the owner of the invitation by checking its email as well
-	if object.Namespace == schema.InvitationNamespace &&
+	if !allowed && object.Namespace == schema.InvitationNamespace &&
 		currentUser.Type == schema.UserPrincipal {
 		result2, checkErr := h.resourceService.CheckAuthz(ctx, resource.Check{
 			Object: object,
@@ -76,12 +74,15 @@ func (h *ConnectHandler) IsAuthorized(ctx context.Context, object relation.Objec
 				"user_email", currentUser.User.Email)
 			return handleAuthErr(checkErr)
 		}
-		if result2 {
-			return nil
-		}
+		allowed = result2
 	}
 
-	return connect.NewError(connect.CodePermissionDenied, ErrUnauthorized)
+	if !allowed {
+		return connect.NewError(connect.CodePermissionDenied, ErrUnauthorized)
+	}
+
+	// the caller has permission; the target must also live in an enabled org
+	return h.ensureObjectOrgActive(ctx, object)
 }
 
 func handleAuthErr(err error) error {