organizations 0.5.0 → 0.7.0

data/lib/generators/organizations/grants/templates/create_organizations_grants.rb.erb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# Scoped resource grants: a membership (or a pending invitation) limited to
+# some records of your app, with a capability list per record.
+class CreateOrganizationsGrants < ActiveRecord::Migration<%= migration_version %>
+  def change
+    # ⚠️ If your user model is NOT `User` (config.user_class), change
+    # `to_table: :users` to your user table before migrating.
+    foreign_key_type = primary_key_type_setting || :bigint
+
+    create_table :organizations_grants, id: primary_key_type_setting || :primary_key do |t|
+      # Exactly one holder: the membership, or the invitation until it is accepted.
+      t.references :membership, null: true, type: foreign_key_type,
+                                foreign_key: { to_table: :organizations_memberships, on_delete: :cascade }
+      t.references :invitation, null: true, type: foreign_key_type,
+                                foreign_key: { to_table: :organizations_invitations, on_delete: :cascade }
+
+      # The granted resource. ⚠️ grantable_id must have the type of the ids
+      # you grant: the app's primary key type by default. Use :uuid or
+      # :string if your resources use other ids.
+      t.string :grantable_type, null: false
+      t.column :grantable_id, foreign_key_type, null: false
+
+      t.send(json_column_type, :capabilities, null: json_column_null, default: json_column_default)
+      t.references :granted_by, null: true, type: foreign_key_type,
+                                foreign_key: { to_table: :users, on_delete: :nullify }
+
+      t.timestamps
+
+      t.check_constraint "(membership_id IS NULL) <> (invitation_id IS NULL)", name: "org_grants_one_holder"
+    end
+
+    add_index :organizations_grants, [ :membership_id, :grantable_type, :grantable_id ],
+              unique: true, name: "index_org_grants_on_membership_and_grantable"
+    add_index :organizations_grants, [ :invitation_id, :grantable_type, :grantable_id ],
+              unique: true, name: "index_org_grants_on_invitation_and_grantable"
+    add_index :organizations_grants, [ :grantable_type, :grantable_id ], name: "index_org_grants_on_grantable"
+  end
+
+  private
+
+  def primary_key_type_setting
+    config = Rails.configuration.generators
+    config.options[config.orm][:primary_key_type]
+  end
+
+  def json_column_type
+    connection.adapter_name.downcase.include?("postgresql") ? :jsonb : :json
+  end
+
+  # MySQL 8+ doesn't allow default values on JSON columns.
+  def json_column_default
+    connection.adapter_name.downcase.include?("mysql") ? nil : []
+  end
+
+  def json_column_null
+    connection.adapter_name.downcase.include?("mysql")
+  end
+end

data/lib/generators/organizations/install/install_generator.rb

@@ -33,6 +33,7 @@ module Organizations
         say "  5. Run 'rails g organizations:views' to copy the reference views"
         say "     (the engine renders HOST views — without them you'll hit"
         say "     missing-template errors on the org/membership/invitation pages)."
+        say "  6. Optional: run 'rails g organizations:join' for the join and access screens."
       end
 
       private

data/lib/generators/organizations/install/templates/create_organizations_tables.rb.erb

@@ -13,6 +13,12 @@ class CreateOrganizationsTables < ActiveRecord::Migration<%= migration_version %
       t.string :name, null: false
       t.integer :memberships_count, default: 0, null: false
       t.send(json_column_type, :metadata, null: json_column_null, default: json_column_default)
+      # The user whose personal organization this is (nil for every other
+      # organization). Unique: one personal organization per user. The row
+      # clears itself if the user row is deleted outside the gem.
+      # (`to_table: :users`: see the note at the top of this migration.)
+      t.references :personal_owner, null: true, type: foreign_key_type, index: { unique: true },
+                                    foreign_key: { to_table: :users, on_delete: :nullify }
 
       t.timestamps
     end
@@ -126,6 +132,15 @@ class CreateOrganizationsTables < ActiveRecord::Migration<%= migration_version %
       t.string :domain, null: false
       t.send(json_column_type, :membership_metadata, null: json_column_null, default: json_column_default)
       t.send(json_column_type, :metadata, null: json_column_null, default: json_column_default)
+      # Domain authority: the sign-up policy (none|suggest|auto_join) and the
+      # proof of control (DNS TXT challenge or operator approval).
+      t.string :join_policy, null: false, default: "none"
+      t.string :verification_token
+      t.datetime :verification_started_at
+      t.datetime :verified_at
+      t.string :verification_method
+      t.references :verified_by, null: true, type: foreign_key_type, foreign_key: { to_table: :users, on_delete: :nullify }
+      t.datetime :verification_revoked_at
 
       t.timestamps
     end

data/lib/generators/organizations/join/join_generator.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+
+module Organizations
+  module Generators
+    # Copies the join screen and the access screen into the host app, with
+    # their routes: host-owned controllers and views around JoinFlow and
+    # JoinState, in the style of `rails g organizations:views`.
+    #
+    #   rails g organizations:join                 # join screen + access screen + routes
+    #   rails g organizations:join --skip-access   # the join screen only
+    #   rails g organizations:join --skip-routes   # add the routes yourself
+    #
+    # The templates are byte-identical to the gem's test/dummy app, where an
+    # HTTP test suite covers them. The engine adds no route: nothing changes
+    # in an app until it runs this generator.
+    class JoinGenerator < Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+      desc "Copies the organization join and access screens (controllers, views, routes) into your app"
+
+      class_option :skip_access, type: :boolean, default: false,
+                                 desc: "Skip the access screen (domains, codes, allowlist, request queue)"
+      class_option :skip_routes, type: :boolean, default: false, desc: "Do not add the routes"
+
+      JOIN_FILES = %w[
+        app/controllers/organization_joins_controller.rb
+        app/views/organization_joins/show.html.erb
+        app/views/organization_joins/_disclosure.html.erb
+      ].freeze
+
+      ROUTES_MARKER = "# organizations: join and access screens"
+      DRAW_ANCHOR = /\.routes\.draw do\s*\n/
+      ACCESS_ANCHOR = /as: :withdraw_join\n/
+
+      ACCESS_FILES = %w[
+        app/controllers/organization_access_controller.rb
+        app/views/organization_access/show.html.erb
+      ].freeze
+
+      # The routes block, without the access routes when access: false.
+      # @return [String]
+      def self.routes_snippet(access: true)
+        snippet = File.read(File.join(source_root, "routes.rb"))
+        return snippet if access
+
+        snippet.lines.reject { |line| line.include?("organization_access#") }.join.gsub(/\n\n+(\s*end)/, "\n\\1")
+      end
+
+      # Only the access routes of the block.
+      # @return [String]
+      def self.access_routes
+        File.read(File.join(source_root, "routes.rb")).lines.select { |line| line.include?("organization_access#") }.join
+      end
+
+      def copy_join_screen
+        JOIN_FILES.each { |file| copy_file file }
+      end
+
+      def copy_access_screen
+        ACCESS_FILES.each { |file| copy_file file } unless options[:skip_access]
+      end
+
+      # Adds the routes block once. A second run adds only what is missing:
+      # the access routes after an earlier --skip-access run.
+      def add_routes
+        return if options[:skip_routes]
+
+        routes = read_routes
+        access = !options[:skip_access]
+        if !routes.include?(ROUTES_MARKER)
+          insert_routes(self.class.routes_snippet(access: access), DRAW_ANCHOR, routes)
+        elsif access && !active_code(routes).include?("organization_access#")
+          insert_routes(self.class.access_routes, ACCESS_ANCHOR, routes)
+        else
+          say_status :identical, "config/routes.rb (the organizations routes are already there)", :blue
+        end
+      end
+
+      no_commands do
+        # Insert after the anchor, or print the routes when the anchor is not
+        # there (an edited routes file): never a silent no-op.
+        def insert_routes(snippet, anchor, routes)
+          if routes.match?(anchor)
+            inject_into_file "config/routes.rb", "\n#{snippet}", after: anchor
+          else
+            say_status :skip, "config/routes.rb: add these routes yourself", :yellow
+            say snippet
+          end
+        end
+
+        def read_routes = File.read(File.join(destination_root, "config/routes.rb"))
+
+        # The routes file without comment lines.
+        def active_code(routes)
+          routes.lines.reject { |line| line.lstrip.start_with?("#") }.join
+        end
+      end
+
+      def show_readme
+        say ""
+        say "Organization join screen copied: GET /orgs/:organization_id/join (organization_join_path).", :green
+        unless options[:skip_access]
+          say "Access screen copied: GET /orgs/:organization_id/access (organization_access_path)."
+        end
+        say "These views use Tailwind classes and the `heroicon` helper (gem \"heroicons\")."
+        say "Before you ship: read the safety rules at the top of each controller,"
+        say "check the rate limits, and edit the disclosure text to match your privacy policy."
+        say ""
+      end
+    end
+  end
+end

data/lib/generators/organizations/join/templates/app/controllers/organization_access_controller.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+# Who can join one organization, and how: email domains (with domain
+# verification and the sign-up policy), join codes, the allowlist, and the
+# queue of pending join requests. Every change goes through the gem's
+# models, never raw row writes.
+#
+# Generated by `rails g organizations:join`. It is yours now: change the
+# copy, the layout and the URL. Keep the safety rules below.
+#
+# Safety rules:
+#   - Organizations::OrganizationScoped takes the organization from the URL,
+#     and every lookup below is scoped to it, so an id from another
+#     organization is a 404.
+#   - The page needs the invite_members permission; domain changes also need
+#     manage_settings. Unknown organizations, strangers and members without
+#     the permission all get the same 404, so the page reveals nothing.
+#   - Only the domain name and the join policy come from params. The
+#     verification columns are written by the gem's methods only.
+#   - Lists from params are cut to a fixed size.
+#   - DNS checks are rate limited (Rails 7.2+).
+class OrganizationAccessController < ApplicationController
+  include Organizations::OrganizationScoped
+
+  MAX_ALLOWLIST_IMPORT = 1_000
+  MAX_ALLOWLIST_INPUT = 300_000 # characters, about 1,000 long addresses
+  MAX_LABEL_LENGTH = 100
+
+  before_action -> { send(Organizations.configuration.authenticate_user_method) }
+  self.organization_param = :organization_id
+  require_organization_permission :invite_members
+  require_organization_permission :manage_settings, only: %i[add_domain update_domain remove_domain
+                                                             start_domain_verification verify_domain]
+
+  # Rails 7.2+, with a shared cache store (see OrganizationJoinsController).
+  rate_limit to: 10, within: 10.minutes, by: -> { viewer.id }, only: :verify_domain if respond_to?(:rate_limit)
+
+  helper_method :organization
+
+  def show
+    @domains = organization.domains.order(:domain)
+    @join_codes = organization.join_codes.order(created_at: :desc)
+    @allowlist_entries = organization.allowlist_entries.unclaimed.order(:email)
+    @pending_requests = organization.join_requests.pending.includes(:user).order(created_at: :asc)
+  end
+
+  def add_domain
+    organization.add_domain!(params[:domain].to_s.first(253))
+    back notice: "Domain added. Verify it before it can admit anyone when verification is required."
+  rescue ActiveRecord::RecordInvalid => e
+    back alert: e.message
+  end
+
+  def update_domain
+    domain.update!(join_policy: params[:join_policy].to_s)
+    back notice: "Join policy saved. It acts once the domain is verified."
+  rescue ActiveRecord::RecordInvalid => e
+    back alert: e.message
+  end
+
+  def remove_domain
+    domain.destroy!
+    back notice: "Domain removed. Existing members keep their membership."
+  end
+
+  def start_domain_verification
+    domain.start_verification!
+    back notice: "Add the TXT record below to your DNS, then press Verify."
+  end
+
+  def verify_domain
+    domain.verify!
+    back notice: "#{domain.domain} is verified."
+  rescue Organizations::DomainVerificationFailed => e
+    back alert: e.message
+  end
+
+  def generate_code
+    code = organization.generate_join_code!(
+      label: params[:label].to_s.first(MAX_LABEL_LENGTH).presence,
+      auto_approve: params[:auto_approve] == "1",
+      created_by: viewer
+    )
+    back notice: "Code #{code.display_code} created."
+  end
+
+  def revoke_code
+    organization.join_codes.find(params[:code_id]).revoke!
+    back notice: "Code revoked. To rotate a code, revoke it and create a new one."
+  end
+
+  # Valid addresses are imported; the rest are counted and skipped.
+  def import_allowlist
+    tokens = params[:emails].to_s.first(MAX_ALLOWLIST_INPUT).split(/[\s,;]+/, MAX_ALLOWLIST_IMPORT + 1)
+    tokens = tokens.compact_blank.first(MAX_ALLOWLIST_IMPORT)
+    valid, invalid = tokens.partition { |email| email.length <= 254 && email.match?(URI::MailTo::EMAIL_REGEXP) }
+    imported = organization.import_allowlist!(valid, source: "manual")
+    message = "#{imported.size} address(es) added to the allowlist."
+    message += " #{invalid.size} skipped: not an email address." if invalid.any?
+    back notice: message
+  end
+
+  def remove_allowlist_entry
+    organization.allowlist_entries.unclaimed.find(params[:entry_id]).destroy!
+    back notice: "Address removed from the allowlist."
+  end
+
+  # Hard limits (seats) belong in config.on_member_joining: the gate also
+  # covers this path, so there is no check to repeat here.
+  def approve_request
+    join_request = organization.join_requests.find(params[:request_id])
+    organization.approve_join_request!(join_request, approved_by: viewer)
+    back notice: "#{join_request.user.email} is now a member."
+  rescue Organizations::MembershipVetoed, Organizations::JoinRequestError => e
+    back alert: e.message
+  end
+
+  def reject_request
+    join_request = organization.join_requests.find(params[:request_id])
+    reason = params[:reason].to_s.first(500).presence
+    organization.reject_join_request!(join_request, rejected_by: viewer, reason: reason)
+    back notice: "Request rejected."
+  rescue Organizations::JoinRequestError => e
+    back alert: e.message
+  end
+
+  private
+
+  def organization
+    current_scoped_organization
+  end
+
+  # The signed-in user, through config.current_user_method.
+  def viewer
+    send(Organizations.configuration.current_user_method)
+  end
+
+  def domain
+    @domain ||= organization.domains.find(params[:domain_id])
+  end
+
+  # 303, so a browser follows a POST or DELETE with a GET.
+  def back(**messages)
+    redirect_to organization_access_path(organization), status: :see_other, **messages
+  end
+end

data/lib/generators/organizations/join/templates/app/controllers/organization_joins_controller.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+# The join screen of one organization: every way in (join code, work email,
+# request to join) at one URL, rendered by Organizations::JoinState and
+# driven by Organizations::JoinFlow.
+#
+# Generated by `rails g organizations:join`. It is yours now: change the
+# copy, the layout and the URL. Keep the safety rules below.
+#
+#   GET    /orgs/:organization_id/join   the screen (a ?code=... link only fills in the form)
+#   POST   /orgs/:organization_id/join   a code, an email, a 6-digit code, or a plain request
+#   DELETE /orgs/:organization_id/join   withdraw the pending request
+#
+# Safety rules:
+#   - A signed-in user is required: JoinFlow needs one.
+#   - Every change is a POST or a DELETE, with Rails' CSRF protection
+#     (ApplicationController's protect_from_forgery). A GET never joins and
+#     never spends a code, also after a sign-in redirect.
+#   - Inputs are cut to a fixed length before they reach the gem.
+#   - Unknown, revoked, expired and foreign codes get one generic message
+#     (JoinFlow does that). Do not tell users which codes exist.
+#   - The current organization of the session does not change here.
+#   - Any signed-in user who has an organization's id sees its name here.
+#     For private tenants, use UUID primary keys or a handle finder.
+#   - Rate limits (Rails 7.2+) cap guessing across requests. The gem itself
+#     throttles each emailed challenge.
+#     They need Rails 7.2+ and a cache store shared by every server process
+#     (Redis, Solid Cache): the null and memory stores do not enforce them
+#     across processes. On Rails 7.1, use Rack::Attack.
+#   - The disclosure partial tells joiners who will see their data. Keep it
+#     visible before any submit.
+#   - A sent code or a pending request redirects (303), as Turbo expects.
+#     Failures render with 422.
+class OrganizationJoinsController < ApplicationController
+  MAX_CODE_LENGTH = 32
+  MAX_EMAIL_LENGTH = 254
+  MAX_VERIFICATION_CODE_LENGTH = 12
+  MAX_MESSAGE_LENGTH = 500
+
+  before_action -> { send(Organizations.configuration.authenticate_user_method) }
+  before_action :set_organization
+
+  if respond_to?(:rate_limit)
+    rate_limit to: 10, within: 1.hour, by: -> { viewer.id }, only: :create
+    rate_limit to: 60, within: 1.minute, by: -> { request.remote_ip }, only: :show
+  end
+
+  def show
+    @state = Organizations::JoinState.for(user: viewer, organization: @organization)
+    @staged_code = bounded(params[:code], MAX_CODE_LENGTH)
+  end
+
+  def create
+    result = Organizations::JoinFlow.attempt(
+      user: viewer,
+      organization: @organization,
+      code: bounded(params[:code], MAX_CODE_LENGTH),
+      email: bounded(params[:email], MAX_EMAIL_LENGTH),
+      verification_code: bounded(params[:verification_code], MAX_VERIFICATION_CODE_LENGTH),
+      message: bounded(params[:message], MAX_MESSAGE_LENGTH)
+    )
+
+    if result.failed?
+      @state = Organizations::JoinState.for(user: viewer, organization: @organization, result: result)
+      flash.now[:alert] = @state.error_message
+      render :show, status: 422
+    else
+      # The screen reads the new state (member, verifying, pending) on the GET.
+      notice = result.member? ? "Welcome to #{@organization.name}!" : nil
+      redirect_to organization_join_path(@organization), status: :see_other, notice: notice
+    end
+  end
+
+  def withdraw
+    viewer.pending_join_request_for(@organization)&.withdraw!
+    redirect_to organization_join_path(@organization), status: :see_other, notice: "Request withdrawn."
+  end
+
+  private
+
+  def set_organization
+    @organization = Organizations::Organization.find(params[:organization_id])
+  end
+
+  # The signed-in user, through config.current_user_method.
+  def viewer
+    send(Organizations.configuration.current_user_method)
+  end
+
+  def bounded(value, limit)
+    value.to_s.strip.first(limit).presence
+  end
+end

data/lib/generators/organizations/join/templates/app/views/organization_access/show.html.erb

@@ -0,0 +1,142 @@
+<%# Who can join, and how: pending requests, email domains (with domain
+    verification and the sign-up policy), join codes and the allowlist.
+    Generated by `rails g organizations:join`. Every form posts to
+    OrganizationAccessController, which changes data through the gem only. %>
+
+<div class="mb-8">
+  <h1 class="text-2xl font-bold text-gray-900">Access — <%= organization.name %></h1>
+  <p class="mt-1 text-sm text-gray-500">Who can join, and how they prove they belong.</p>
+</div>
+
+<div class="space-y-8">
+  <%# ── Pending requests ─────────────────────────────────────────────── %>
+  <section class="rounded-xl border border-gray-200 bg-white p-6 shadow-sm">
+    <h2 class="text-lg font-semibold text-gray-900">Pending requests</h2>
+    <% if @pending_requests.blank? %>
+      <p class="mt-2 text-sm text-gray-500">Nobody is waiting.</p>
+    <% else %>
+      <ul class="mt-4 divide-y divide-gray-100">
+        <% @pending_requests.each do |request| %>
+          <li class="flex items-center justify-between gap-4 py-3">
+            <div>
+              <div class="text-sm font-medium text-gray-900"><%= request.user.email %></div>
+              <div class="text-xs text-gray-500">
+                <%= request.email_verified? ? "verified #{request.verification_email}" : "unverified" %>
+                · <%= request.message.presence || "no message" %>
+              </div>
+            </div>
+            <div class="flex gap-2">
+              <%= button_to "Approve", organization_approve_access_request_path(organization, request_id: request.id),
+                    method: :post, class: "rounded-lg bg-green-600 px-3 py-1.5 text-xs font-semibold text-white hover:bg-green-700 cursor-pointer" %>
+              <%= button_to "Reject", organization_reject_access_request_path(organization, request_id: request.id),
+                    method: :post, class: "rounded-lg border border-gray-300 px-3 py-1.5 text-xs font-semibold text-gray-700 hover:bg-gray-50 cursor-pointer" %>
+            </div>
+          </li>
+        <% end %>
+      </ul>
+    <% end %>
+  </section>
+
+  <%# ── Email domains ─────────────────────────────────────────────────── %>
+  <section class="rounded-xl border border-gray-200 bg-white p-6 shadow-sm">
+    <h2 class="text-lg font-semibold text-gray-900">Email domains</h2>
+    <p class="mt-1 text-sm text-gray-500">Anyone proving an inbox under these domains can join (emailed 6-digit code, or instantly with a confirmed account email). Verify each domain to prove the organization controls it.</p>
+    <ul class="mt-4 space-y-3">
+      <% @domains.each do |domain| %>
+        <li class="rounded-lg bg-gray-50 px-3 py-2">
+          <div class="flex items-center justify-between gap-2">
+            <div>
+              <code class="text-sm text-gray-900">@<%= domain.domain %></code>
+              <span class="ml-2 inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium <%= domain.verified? ? "bg-green-100 text-green-700" : "bg-gray-200 text-gray-600" %>">
+                <%= if domain.verified? then "verified" elsif domain.revoked? then "revoked" else "not verified" end %>
+              </span>
+            </div>
+            <%= button_to "Remove", organization_access_domain_path(organization, domain_id: domain.id),
+                  method: :delete, class: "text-xs font-medium text-gray-500 hover:text-red-600 cursor-pointer bg-transparent" %>
+          </div>
+
+          <%# Domain verification: a TXT record proves that the organization controls the domain. %>
+          <% unless domain.verified? %>
+            <div class="mt-2 text-xs text-gray-600">
+              <% if domain.verification_record_value && !domain.verification_expired? %>
+                <p>Add this TXT record to your DNS, then press Verify:</p>
+                <p class="mt-1"><code class="break-all"><%= domain.verification_record_name %></code></p>
+                <p><code class="break-all"><%= domain.verification_record_value %></code></p>
+                <%= button_to "Verify", organization_verify_access_domain_path(organization, domain_id: domain.id),
+                      method: :post, class: "mt-2 rounded-lg bg-slate-600 px-3 py-1 text-xs font-semibold text-white hover:bg-slate-700 cursor-pointer" %>
+              <% else %>
+                <%= button_to "Start verification", organization_access_domain_verification_path(organization, domain_id: domain.id),
+                      method: :post, class: "rounded-lg border border-slate-600 px-3 py-1 text-xs font-semibold text-slate-700 hover:bg-white cursor-pointer" %>
+              <% end %>
+            </div>
+          <% end %>
+
+          <%# The sign-up policy acts only once the domain is verified. %>
+          <%= form_with url: organization_access_domain_path(organization, domain_id: domain.id), method: :patch, class: "mt-2 flex items-center gap-2 text-xs" do |form| %>
+            <label class="text-gray-600">At sign-up:</label>
+            <%= form.select :join_policy,
+                  [["Do nothing", "none"], ["Suggest joining", "suggest"], ["Join automatically", "auto_join"]],
+                  { selected: domain.join_policy }, class: "rounded-lg border-gray-300 text-xs" %>
+            <%= form.submit "Save", class: "font-medium text-slate-600 hover:text-slate-800 cursor-pointer bg-transparent border-0 p-0" %>
+          <% end %>
+        </li>
+      <% end %>
+    </ul>
+    <%= form_with url: organization_access_domains_path(organization), method: :post, class: "mt-4 flex gap-2" do |form| %>
+      <%= form.text_field :domain, placeholder: "company.com", required: true, maxlength: 253,
+            class: "block w-full rounded-lg border-gray-300 text-sm focus:border-slate-500 focus:ring-slate-500" %>
+      <%= form.submit "Add", class: "rounded-lg bg-slate-600 px-4 py-2 text-sm font-semibold text-white hover:bg-slate-700 cursor-pointer" %>
+    <% end %>
+  </section>
+
+  <%# ── Join codes ────────────────────────────────────────────────────── %>
+  <section class="rounded-xl border border-gray-200 bg-white p-6 shadow-sm">
+    <h2 class="text-lg font-semibold text-gray-900">Join codes</h2>
+    <p class="mt-1 text-sm text-gray-500">Shareable PINs for posters, chats, and onboarding docs. Rotation = revoke + create a new one.</p>
+    <ul class="mt-4 space-y-2">
+      <% @join_codes.each do |code| %>
+        <li class="flex items-center justify-between rounded-lg bg-gray-50 px-3 py-2">
+          <div>
+            <code class="text-sm font-semibold tracking-widest text-gray-900"><%= code.display_code %></code>
+            <span class="ml-2 text-xs text-gray-500"><%= code.label %></span>
+            <span class="ml-2 inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium <%= code.active? ? "bg-green-100 text-green-700" : "bg-gray-200 text-gray-600" %>">
+              <%= code.status %> · <%= code.uses_count %> uses
+            </span>
+          </div>
+          <% if code.active? %>
+            <%= button_to "Revoke", organization_revoke_access_code_path(organization, code_id: code.id),
+                  method: :post, class: "text-xs font-medium text-gray-500 hover:text-red-600 cursor-pointer bg-transparent" %>
+          <% end %>
+        </li>
+      <% end %>
+    </ul>
+    <%= form_with url: organization_access_codes_path(organization), method: :post, class: "mt-4 flex items-center gap-2" do |form| %>
+      <%= form.text_field :label, placeholder: "Label (e.g. onboarding doc)", maxlength: 100,
+            class: "block w-full rounded-lg border-gray-300 text-sm focus:border-slate-500 focus:ring-slate-500" %>
+      <label class="flex shrink-0 items-center gap-1 text-xs text-gray-600">
+        <%= form.check_box :auto_approve, { checked: true }, "1", "0" %> auto-approve
+      </label>
+      <%= form.submit "Create", class: "rounded-lg bg-slate-600 px-4 py-2 text-sm font-semibold text-white hover:bg-slate-700 cursor-pointer" %>
+    <% end %>
+  </section>
+
+  <%# ── Allowlist ─────────────────────────────────────────────────────── %>
+  <section class="rounded-xl border border-gray-200 bg-white p-6 shadow-sm">
+    <h2 class="text-lg font-semibold text-gray-900">Allowlist</h2>
+    <p class="mt-1 text-sm text-gray-500">Exact addresses (rosters, mixed-provider orgs). Rostered users still verify their inbox — a leaked roster grants nothing.</p>
+    <ul class="mt-4 flex flex-wrap gap-2">
+      <% @allowlist_entries.each do |entry| %>
+        <li class="inline-flex items-center gap-1 rounded-full bg-gray-100 px-3 py-1 text-xs text-gray-700">
+          <%= entry.email %>
+          <%= button_to "×", organization_access_allowlist_entry_path(organization, entry_id: entry.id), method: :delete,
+                title: "Remove", class: "text-gray-400 hover:text-red-600 cursor-pointer bg-transparent" %>
+        </li>
+      <% end %>
+    </ul>
+    <%= form_with url: organization_access_allowlist_path(organization), method: :post, class: "mt-4 space-y-2" do |form| %>
+      <%= form.text_area :emails, rows: 2, placeholder: "ana@gmail.com, luis@yahoo.es …",
+            class: "block w-full rounded-lg border-gray-300 text-sm focus:border-slate-500 focus:ring-slate-500" %>
+      <%= form.submit "Import", class: "rounded-lg bg-slate-600 px-4 py-2 text-sm font-semibold text-white hover:bg-slate-700 cursor-pointer" %>
+    <% end %>
+  </section>
+</div>

data/lib/generators/organizations/join/templates/app/views/organization_joins/_disclosure.html.erb

@@ -0,0 +1,8 @@
+<%# Who will see what. Tell joiners before they submit anything: the
+    admins of the organization see their name, their account email and the
+    email address they verify (the access screen shows all three), and a
+    pending request keeps that address until it is decided.
+    Change the text to match your product and your privacy policy. %>
+<p class="mt-1 text-xs text-gray-500">
+  The admins of <%= organization.name %> will see your name, your account email, and the email address you use to join.
+</p>