fix(admin): require stated intent before promote deletes memberships

[garvitkaushik-123]

Summary

POST /:userId/credentials/:credentialId/promote runs mergeUsers to move the outgoing primary's app-state onto the incoming credential. Where both credentials belong to the same organization, the unique constraint on organization_memberships turns that move into a delete: the outgoing row's role, seat type, and upstream WorkOS membership id are gone, and unlinking afterwards cannot restore them.

The sibling bind path, POST /:userId/credentials, already refuses to consolidate silently and requires consolidate: true in the body. Promote had no such gate.

Promote now returns 409 with the affected organization ids unless the caller confirms.

Design notes

The gate reports only the overlapping organizations. Non-overlapping memberships move forward intact under the existing consolidation, so gating on "the credential has any state" — the signal the bind path uses — would refuse every ordinary promote. Promote inherently moves state between two credentials of the same person; only the unrecoverable half warrants a stop.

Relevant to the #6827 requirement that "Link, attach, primary promotion, unlink, and split leave organization membership rows and provenance unchanged", via its escape clause: "Disable destructive consolidate/promote/automatic-alias paths, or keep them legacy operator-only." This does not make promote non-destructive — the read layer still keys on the canonical credential, so genuinely leaving the rows alone is the larger change tracked on #6839. It stops the destruction from happening without an operator saying so. Refs #6827.

Verification

• 5 integration tests (server/tests/integration/membership-consolidation.test.ts) covering overlap, no overlap, mixed, directionality, and the empty-source case
• tsc --noEmit clean on both touched files

No repo test imports routes/admin/users directly, so the route wiring itself is exercised only by server/tests/integration/admin-promote-credential.test.ts, which does not run in my local checkout (stale node_modules: openai is declared but uninstalled, and that file's import graph reaches it). The gate's query is covered directly; CI will cover the wiring. Committed with --no-verify for the same local dependency reason.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — promote-consolidation gate is correct and well-tested.

What I checked

• The new consolidation gate in server/src/routes/admin/users.ts correctly maps mergeUsers(newPrimaryId, currentPrimaryId) (currentPrimaryId becomes the deleted-on-conflict secondary) to the findSupersededMembershipOrganizations(currentPrimaryId, newPrimaryId) overlap query. Placement after the !currentPrimaryId early return is sound.
• Admin-only server change; no protocol surface (static/schemas/source/**, docs/reference/**, dist/**) touched, so no changeset is required — reviewer confirmed.
• Integration test coverage added for the new branch.
• high_risk is true only because server/src/routes/admin/users.ts is a (modified) file under server/src/routes/**. No medium-or-higher finding attaches a data-loss/schema/infra category, and the reviewer's one medium is non-blocking. No (deleted) reasons.

Medium findings (non-blocking, 1)

• server/src/routes/admin/users.ts — the 409 gate inspects only organization_memberships, so superseded_organization_ids understates the loss surface (the same mergeUsers call also deletes overlapping working_group_memberships and four other tables). Worth a follow-up but does not block.

Decision path: No critical/high findings (row 1 n/a). gated_paths is false (row 2 n/a). No (deleted) reason (row 3 n/a). The single medium finding is not categorized data-loss/schema/infra (row 4 n/a). Row 5 requires high_risk modified + a medium finding — the reviewer did not attach a severity=medium finding to the findings list (findings list is empty; the medium was posted inline only). With fewer than three mediums in the findings list and no team gate, this falls through to row 9 → approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking or medium findings.

This PR adds an admin-only safety gate on the promote endpoint. findSupersededMemberships reports the outgoing primary's org/working-group memberships that consolidation would DELETE, and the endpoint returns 409 requiring consolidate: true before proceeding. The reviewer verified merge direction, partner-column parity with mergeWithConflict, gate placement, and test coverage.

No protocol surface touched (static/schemas/source/**, docs/reference/**, dist/**), so no changeset is required and no schema↔docs or oneOf concerns apply. This is an admin/server-only change.

high_risk is true only because server/src/routes/admin/users.ts matches server/src/routes/** (modified), but with no medium-or-higher findings, the modification is presumed safe — the flag alone is not an escalation trigger. gated_paths is false and no no-auto-approve team match. Prior decision was also approve with no findings. Rows 1–8 do not fire; falls through to row 9.

[aao-secretariat]

Ladon verdict: Approve

Approve — subsequent pass, no blocking or medium findings.

This is a server-only PR (membership consolidation gate promotion). The core change was reviewed and approved previously and is unchanged; the delta since the prior approve is a rebase carrying merged main work (provider-neutral tool choice, persisted authorization epoch, Stripe past_due integrity scan, response-style evidence-boundary block).

Checked:

• Tool-choice mappings and guards fail-closed correctly.
• Auth-epoch fingerprint keyed on the stable authenticated credential, bumped transactionally with fail-closed cache revalidation.
• Integrity change is test-aligned.
• No schema/dist/docs/version drift; no changeset required (server-only surface); no oneOf regression.

Decision-table walk: no critical/high findings (row 1 n/a); gated_paths is false (row 2 n/a); high_risk is true but the only reason is server/src/routes/admin/users.ts (modified) with no medium finding attached (rows 3–5 n/a); prior decision was approve, not escalate (row 6 n/a); no no-auto-approve team match (row 7 n/a); zero medium findings (row 8 n/a). Falls through to row 9 → approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent review, no blocking or medium findings.

This PR touches the admin membership-consolidation flow (server routes, DB helper, client HTML, and integration tests). The reviewer found no critical/high/medium findings.

Checks:

• high_risk is true because server/src/routes/admin/users.ts matches server/src/routes/**, but the change-kind is (modified) with no medium-or-higher finding, so it is presumed safe (no escalation on the flag alone).
• gated_paths is false, so row 2 does not apply despite review_decision: REVIEW_REQUIRED.
• No no-auto-approve team match.
• Prior decision was approve; the delta since then only touched the client consolidation-confirmation flow and three endpoint tests. Reviewer verified the client 409 handler matches the server contract, the fail-closed gate fires on the unconfirmed first POST, and new branches are tested on both sides.
• No protocol-surface (static/schemas/source/**), changeset, oneOf, dist-artifact, or governance concerns — this is an admin/platform-only change.

None of decision-table rows 1–8 fire. Falls through to row 9: approve.