organizations 0.6.0 → 0.7.0

data/app/controllers/organizations/invitations_controller.rb

@@ -35,55 +35,60 @@ module Organizations
       email = invitation_params[:email]
       role = invitation_params[:role] || ::Organizations.configuration.default_invitation_role
 
-      begin
-        @invitation = current_user.send_organization_invite_to!(
-          email,
-          organization: current_organization,
-          role: role
-        )
+      @invitation = current_user.send_organization_invite_to!(
+        email,
+        organization: current_organization,
+        role: role
+      )
 
-        respond_to do |format|
-          return_to = params[:return_to].presence || organization_invitations_path
-          format.html { redirect_to return_to, notice: "Invitation sent to #{email}" }
-          format.json { render json: invitation_json(@invitation), status: :created }
-        end
-      rescue ::Organizations::InvitationError, ActiveRecord::RecordInvalid, ArgumentError => e
-        respond_to do |format|
-          format.html do
-            @invitation = current_organization.invitations.build(invitation_params)
-            flash.now[:alert] = e.message
-            render :new, status: :unprocessable_entity
-          end
-          format.json { render json: { error: e.message }, status: :unprocessable_entity }
+      respond_to do |format|
+        return_to = params[:return_to].presence || organization_invitations_path
+        format.html { redirect_to return_to, notice: "Invitation sent to #{email}" }
+        format.json { render json: invitation_json(@invitation), status: :created }
+      end
+    rescue ::Organizations::NotAuthorized => e # e.g. a role the inviter may not act on
+      handle_not_authorized(e)
+    rescue ::Organizations::InvitationError, ::Organizations::Organization::CannotInviteAsOwner,
+           ActiveRecord::RecordInvalid, ArgumentError => e
+      respond_to do |format|
+        format.html do
+          @invitation = current_organization.invitations.build(invitation_params)
+          flash.now[:alert] = e.message
+          render :new, status: 422
         end
+        format.json { render json: { error: e.message }, status: 422 }
       end
     end
 
     # DELETE /invitations/:id
     # Revoke/delete an invitation
     def destroy
-      @invitation.destroy!
+      @invitation.revoke!(revoked_by: current_user)
 
       respond_to do |format|
         format.html { redirect_back fallback_location: organization_invitations_path, notice: "Invitation revoked" }
         format.json { head :no_content }
       end
+    rescue ::Organizations::NotAuthorized => e # an invitation for a role the requester may not act on
+      handle_not_authorized(e)
     end
 
     # POST /invitations/:id/resend
     # Resend an invitation email
     def resend
       begin
-        @invitation.resend!
+        @invitation.resend!(resent_by: current_user)
 
         respond_to do |format|
           format.html { redirect_back fallback_location: organization_invitations_path, notice: "Invitation resent to #{@invitation.email}" }
           format.json { render json: invitation_json(@invitation) }
         end
+      rescue ::Organizations::NotAuthorized => e # an invitation for a role the requester may not act on
+        handle_not_authorized(e)
       rescue ::Organizations::InvitationAlreadyAccepted => e
         respond_to do |format|
           format.html { redirect_back fallback_location: organization_invitations_path, alert: e.message }
-          format.json { render json: { error: e.message }, status: :unprocessable_entity }
+          format.json { render json: { error: e.message }, status: 422 }
         end
       end
     end

data/app/controllers/organizations/memberships_controller.rb

@@ -28,36 +28,35 @@ module Organizations
     def update
       # Validate the requester can make this change
       validate_role_change!
-
       new_role = membership_params[:role].to_sym
 
-      begin
-        # Use the invariant-safe domain method that enforces owner rules
-        current_organization.change_role_of!(
-          @membership.user,
-          to: new_role,
-          changed_by: current_user
-        )
+      # Use the invariant-safe domain method that enforces owner rules
+      current_organization.change_role_of!(
+        @membership.user,
+        to: new_role,
+        changed_by: current_user
+      )
 
-        # Reload to get updated role
-        @membership.reload
+      # Reload to get updated role
+      @membership.reload
 
-        respond_to do |format|
-          format.html { redirect_back fallback_location: memberships_path, notice: "Role updated successfully." }
-          format.json { render json: membership_json(@membership) }
-        end
-      rescue Organizations::Organization::CannotHaveMultipleOwners,
-             Organizations::Organization::CannotDemoteOwner,
-             Organizations::Error => e
-        respond_to do |format|
-          format.html { redirect_back fallback_location: memberships_path, alert: e.message }
-          format.json { render json: { error: e.message }, status: :unprocessable_entity }
-        end
-      rescue ActiveRecord::RecordInvalid => e
-        respond_to do |format|
-          format.html { redirect_back fallback_location: memberships_path, alert: e.record.errors.full_messages.join(", ") }
-          format.json { render json: { errors: e.record.errors }, status: :unprocessable_entity }
-        end
+      respond_to do |format|
+        format.html { redirect_back fallback_location: memberships_path, notice: "Role updated successfully." }
+        format.json { render json: membership_json(@membership) }
+      end
+    rescue Organizations::NotAuthorized => e # own role, or a role above the requester's
+      handle_not_authorized(e)
+    rescue Organizations::Organization::CannotHaveMultipleOwners,
+           Organizations::Organization::CannotDemoteOwner,
+           Organizations::Error => e
+      respond_to do |format|
+        format.html { redirect_back fallback_location: memberships_path, alert: e.message }
+        format.json { render json: { error: e.message }, status: 422 }
+      end
+    rescue ActiveRecord::RecordInvalid => e
+      respond_to do |format|
+        format.html { redirect_back fallback_location: memberships_path, alert: e.record.errors.full_messages.join(", ") }
+        format.json { render json: { errors: e.record.errors }, status: 422 }
       end
     end
 
@@ -72,10 +71,12 @@ module Organizations
         format.html { redirect_back fallback_location: memberships_path, notice: "Member removed successfully." }
         format.json { head :no_content }
       end
+    rescue Organizations::NotAuthorized => e # self, the owner, or a role above the requester's
+      handle_not_authorized(e)
     rescue Organizations::Organization::CannotRemoveOwner, Organizations::Error => e
       respond_to do |format|
         format.html { redirect_back fallback_location: memberships_path, alert: e.message }
-        format.json { render json: { error: e.message }, status: :unprocessable_entity }
+        format.json { render json: { error: e.message }, status: 422 }
       end
     end
 
@@ -99,7 +100,7 @@ module Organizations
              Error => e
         respond_to do |format|
           format.html { redirect_back fallback_location: organizations_path, alert: e.message }
-          format.json { render json: { error: e.message }, status: :unprocessable_entity }
+          format.json { render json: { error: e.message }, status: 422 }
         end
       end
     end
@@ -121,7 +122,7 @@ module Organizations
              Organizations::Error => e
         respond_to do |format|
           format.html { redirect_back fallback_location: memberships_path, alert: e.message }
-          format.json { render json: { error: e.message }, status: :unprocessable_entity }
+          format.json { render json: { error: e.message }, status: 422 }
         end
       end
     end
@@ -155,7 +156,9 @@ module Organizations
       end
 
       # Note: Owner promotion/demotion rules are enforced by Organization#change_role_of!
-      # which will raise CannotHaveMultipleOwners or CannotDemoteOwner as appropriate
+      # which will raise CannotHaveMultipleOwners or CannotDemoteOwner as appropriate.
+      # It also raises NotAuthorized when the requester may not act on the member's
+      # current role or the new role; #update answers that like a failed permission guard.
     end
 
     def validate_removal!
@@ -178,6 +181,10 @@ module Organizations
           user: current_user
         )
       end
+
+      # Note: Organization#remove_member! raises NotAuthorized when the requester
+      # may not act on the member's role; #destroy answers that like a failed
+      # permission guard.
     end
 
     # JSON serialization helpers

data/app/controllers/organizations/organizations_controller.rb

@@ -51,18 +51,18 @@ module Organizations
           format.html do
             @organization = Organization.new(organization_params)
             flash.now[:alert] = e.message
-            render :new, status: :unprocessable_entity
+            render :new, status: 422
           end
-          format.json { render json: { error: e.message }, status: :unprocessable_entity }
+          format.json { render json: { error: e.message }, status: 422 }
         end
       rescue ActiveRecord::RecordInvalid => e
         respond_to do |format|
           format.html do
             @organization = Organization.new(organization_params)
             flash.now[:alert] = e.record.errors.full_messages.join(", ")
-            render :new, status: :unprocessable_entity
+            render :new, status: 422
           end
-          format.json { render json: { errors: e.record.errors }, status: :unprocessable_entity }
+          format.json { render json: { errors: e.record.errors }, status: 422 }
         end
       end
     end
@@ -82,8 +82,8 @@ module Organizations
         end
       else
         respond_to do |format|
-          format.html { render :edit, status: :unprocessable_entity }
-          format.json { render json: { errors: @organization.errors }, status: :unprocessable_entity }
+          format.html { render :edit, status: 422 }
+          format.json { render json: { errors: @organization.errors }, status: 422 }
         end
       end
     end
@@ -132,14 +132,14 @@ module Organizations
       role = current_user.role_in(@organization)
       return if role && Roles.has_permission?(role, :manage_settings)
 
-      handle_unauthorized(permission: :manage_settings)
+      handle_unauthorized(permission: :manage_settings, organization: @organization)
     end
 
     def authorize_delete_organization!
       role = current_user.role_in(@organization)
       return if role && Roles.has_permission?(role, :delete_organization)
 
-      handle_unauthorized(permission: :delete_organization)
+      handle_unauthorized(permission: :delete_organization, organization: @organization)
     end
 
     # JSON serialization helpers

data/app/controllers/organizations/public_invitations_controller.rb

@@ -76,7 +76,7 @@ module Organizations
         html_path: main_app.root_path,
         alert: "Unable to accept this invitation.",
         json_error: "Acceptance failed",
-        status: :unprocessable_entity
+        status: 422
       )
     end
 

data/app/mailers/organizations/invitation_mailer.rb

@@ -36,14 +36,14 @@ module Organizations
       mail(
         to: invitation.email,
         subject: Organizations.t(:"mailers.invitation.subject",
-                                 inviter: @inviter_name, organization: @organization.name)
+                                 inviter: @inviter_name, organization: @organization)
       )
     end
 
     private
 
     def inviter_name
-      return Organizations.t(:"mailers.from_team") unless @inviter
+      return Organizations.t(:"mailers.from_team", organization: @organization) unless @inviter
 
       if @inviter.respond_to?(:name) && @inviter.name.present?
         @inviter.name

data/app/mailers/organizations/verification_mailer.rb

@@ -30,7 +30,7 @@ module Organizations
       mail(
         to: join_request.verification_email,
         subject: Organizations.t(:"mailers.verification.subject",
-                                 code: @code, organization: @organization.name)
+                                 code: @code, organization: @organization)
       )
     end
 

data/app/models/organizations/grant.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Reloadable entrypoint for Organizations::Grant in Rails apps.
+# This file lives in app/models so Zeitwerk manages it, making the class
+# reload-safe. It delegates to the canonical implementation in lib/.
+load File.expand_path("../../../lib/organizations/models/grant.rb", __dir__)

data/app/views/organizations/invitation_mailer/invitation_email.html.erb

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title><%= Organizations.t(:"mailers.invitation.title", organization: @organization.name) %></title>
+  <title><%= Organizations.t(:"mailers.invitation.title", organization: @organization) %></title>
   <style>
     body {
       font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
@@ -53,11 +53,11 @@
 </head>
 <body>
   <div class="header">
-    <h1><%= Organizations.t(:"mailers.invitation.header") %></h1>
+    <h1><%= Organizations.t(:"mailers.invitation.header", organization: @organization) %></h1>
   </div>
 
   <div class="content">
-    <p><%= Organizations.t(:"mailers.invitation.greeting") %></p>
+    <p><%= Organizations.t(:"mailers.invitation.greeting", organization: @organization) %></p>
 
     <p>
       <%# The *_html keys go through the view `t` helper: its _html-suffix
@@ -65,36 +65,36 @@
           interpolated value (inviter/org names are user input). Source:
           https://guides.rubyonrails.org/i18n.html#using-safe-html-translations %>
       <% if @inviter %>
-        <%= t("organizations.mailers.invitation.invited_by_html", inviter: @inviter_name, organization: @organization.name) %>
+        <% primary, *fallbacks = Organizations.i18n_keys(:"mailers.invitation.invited_by_html", organization: @organization) %><%= t(primary, default: fallbacks, inviter: @inviter_name, organization: @organization.name) %>
       <% else %>
-        <%= t("organizations.mailers.invitation.invited_generic_html", organization: @organization.name) %>
+        <% primary, *fallbacks = Organizations.i18n_keys(:"mailers.invitation.invited_generic_html", organization: @organization) %><%= t(primary, default: fallbacks, organization: @organization.name) %>
       <% end %>
     </p>
 
     <p>
-      <%= Organizations.t(:"mailers.invitation.joining_as_label") %>
-      <span class="role-badge"><%= Organizations.t(:"roles.#{@invitation.role}", default: @invitation.role.to_s.capitalize) %></span>
+      <%= Organizations.t(:"mailers.invitation.joining_as_label", organization: @organization) %>
+      <span class="role-badge"><%= Organizations.t(:"roles.#{@invitation.role}", organization: @organization, default: @invitation.role.to_s.capitalize) %></span>
     </p>
 
     <p style="text-align: center;">
-      <a href="<%= @accept_url %>" class="button"><%= Organizations.t(:"mailers.invitation.accept_button") %></a>
+      <a href="<%= @accept_url %>" class="button"><%= Organizations.t(:"mailers.invitation.accept_button", organization: @organization) %></a>
     </p>
 
     <p>
-      <%= Organizations.t(:"mailers.invitation.copy_link") %><br>
+      <%= Organizations.t(:"mailers.invitation.copy_link", organization: @organization) %><br>
       <a href="<%= @accept_url %>"><%= @accept_url %></a>
     </p>
 
     <% if @expires_on %>
     <p style="color: #666; font-size: 14px;">
-      <%= Organizations.t(:"mailers.invitation.expires_on", date: @expires_on) %>
+      <%= Organizations.t(:"mailers.invitation.expires_on", organization: @organization, date: @expires_on) %>
     </p>
     <% end %>
   </div>
 
   <div class="footer">
     <p>
-      <%= Organizations.t(:"mailers.invitation.ignore") %>
+      <%= Organizations.t(:"mailers.invitation.ignore", organization: @organization) %>
     </p>
   </div>
 </body>

data/app/views/organizations/invitation_mailer/invitation_email.text.erb

@@ -1,18 +1,18 @@
-<%= Organizations.t(:"mailers.invitation.title", organization: @organization.name) %>
+<%= Organizations.t(:"mailers.invitation.title", organization: @organization) %>
 
-<%= Organizations.t(:"mailers.invitation.greeting") %>
+<%= Organizations.t(:"mailers.invitation.greeting", organization: @organization) %>
 
-<% if @inviter %><%= Organizations.t(:"mailers.invitation.invited_by", inviter: @inviter_name, organization: @organization.name) %><% else %><%= Organizations.t(:"mailers.invitation.invited_generic", organization: @organization.name) %><% end %>
+<% if @inviter %><%= Organizations.t(:"mailers.invitation.invited_by", organization: @organization, inviter: @inviter_name) %><% else %><%= Organizations.t(:"mailers.invitation.invited_generic", organization: @organization) %><% end %>
 
-<%= Organizations.t(:"mailers.invitation.joining_as", role: Organizations.t(:"roles.#{@invitation.role}", default: @invitation.role.to_s.capitalize)) %>
+<%= Organizations.t(:"mailers.invitation.joining_as", organization: @organization, role: Organizations.t(:"roles.#{@invitation.role}", organization: @organization, default: @invitation.role.to_s.capitalize)) %>
 
-<%= Organizations.t(:"mailers.invitation.accept_cta") %>
+<%= Organizations.t(:"mailers.invitation.accept_cta", organization: @organization) %>
 <%= @accept_url %>
 
 <% if @expires_on %>
-<%= Organizations.t(:"mailers.invitation.expires_on", date: @expires_on) %>
+<%= Organizations.t(:"mailers.invitation.expires_on", organization: @organization, date: @expires_on) %>
 <% end %>
 
 ---
 
-<%= Organizations.t(:"mailers.invitation.ignore") %>
+<%= Organizations.t(:"mailers.invitation.ignore", organization: @organization) %>

data/app/views/organizations/verification_mailer/code_email.html.erb

@@ -7,16 +7,16 @@
     <%# _html key via the view `t` helper: html_safe translation, escaped
         interpolations (the org name is user input). Source:
         https://guides.rubyonrails.org/i18n.html#using-safe-html-translations %>
-    <p><%= t("organizations.mailers.verification.lead_html", organization: @organization.name) %></p>
+    <p><% primary, *fallbacks = Organizations.i18n_keys(:"mailers.verification.lead_html", organization: @organization) %><%= t(primary, default: fallbacks, organization: @organization.name) %></p>
 
     <p style="font-size: 32px; font-weight: 700; letter-spacing: 6px; background: #f3f4f6; border-radius: 8px; display: inline-block; padding: 12px 24px;">
       <%= @code %>
     </p>
 
-    <p><%= Organizations.t(:"mailers.verification.expires", minutes: @expires_in_minutes) %></p>
+    <p><%= Organizations.t(:"mailers.verification.expires", organization: @organization, minutes: @expires_in_minutes) %></p>
 
     <p style="color: #6b7280; font-size: 14px;">
-      <%= Organizations.t(:"mailers.verification.ignore", organization: @organization.name) %>
+      <%= Organizations.t(:"mailers.verification.ignore", organization: @organization) %>
     </p>
   </body>
 </html>

data/app/views/organizations/verification_mailer/code_email.text.erb

@@ -1,7 +1,7 @@
-<%= Organizations.t(:"mailers.verification.lead", organization: @organization.name) %>
+<%= Organizations.t(:"mailers.verification.lead", organization: @organization) %>
 
   <%= @code %>
 
-<%= Organizations.t(:"mailers.verification.expires", minutes: @expires_in_minutes) %>
+<%= Organizations.t(:"mailers.verification.expires", organization: @organization, minutes: @expires_in_minutes) %>
 
-<%= Organizations.t(:"mailers.verification.ignore", organization: @organization.name) %>
+<%= Organizations.t(:"mailers.verification.ignore", organization: @organization) %>

data/config/locales/en.yml

@@ -79,18 +79,34 @@ en:
       invite_as_owner: "Cannot invite as owner. Invite as admin, then use transfer_ownership_to! after they join."
       invite_not_a_member: "Only organization members can send invitations"
       invite_not_authorized: "You don't have permission to invite members"
+      invite_role_outranks_actor: "You can't invite someone as %{role} because that role ranks above yours"
+      invitation_management_outranks_actor: "You can't revoke or resend an invitation for the %{role} role because it ranks above yours"
 
       # — Ownership / role invariants (reachable from admin UIs) —
       cannot_remove_owner: "Cannot remove the organization owner. Transfer ownership first."
+      member_removal_outranks_actor: "You can't remove a member with the %{role} role because it ranks above yours"
       cannot_add_as_owner: "Cannot add member as owner. Use transfer_ownership_to! instead."
       cannot_promote_to_owner: "Cannot promote to owner. Use transfer_ownership_to! instead."
       cannot_demote_owner_directly: "Cannot demote owner directly. Use transfer_ownership_to! instead."
       cannot_demote_owner: "Cannot demote owner. Transfer ownership first."
       promote_not_higher: "Cannot promote to %{new_role} - it's not a higher role than %{role}"
       demote_not_lower: "Cannot demote to %{new_role} - it's not a lower role than %{role}"
+      role_change_outranks_actor: "You can't give or take away the %{role} role because it ranks above yours"
+      role_has_permissions_actor_lacks: "You can't act on the %{role} role because it has permissions you do not have"
       transfer_no_owner: "Cannot transfer ownership because organization has no owner membership"
       transfer_to_non_member: "Cannot transfer ownership to a non-member"
       transfer_to_non_admin: "Cannot transfer ownership to non-admin. Promote them to admin first."
+      transfer_personal_organization: "A personal organization stays with its owner. Convert it to a shared organization first."
+      domain_operator_is_member: "A member of the organization cannot approve its own domain claim."
+      grant_not_authorized: "You don't have permission to manage access to resources."
+      grant_outranks_actor: "You can't manage the access of a member whose role ranks above yours."
+      grant_exceeds_actor: "You can only give access that you have yourself."
+      domain_verification:
+        not_started: "Start the domain verification first."
+        expired: "The domain verification expired. Start it again."
+        changed: "The domain claim changed during the check. Start the verification again."
+        record_not_found: "The DNS TXT record was not found. DNS changes can take a while to spread."
+        lookup_failed: "The DNS lookup failed. Try again later."
 
       # — Leaving / user-level —
       cannot_leave_as_last_owner: "Cannot leave organization as the only owner. Transfer ownership first."
@@ -119,6 +135,12 @@ en:
     attributes:
       membership_taken: "is already a member of this organization"
       owner_taken: "owner already exists for this organization"
+      personal_owner_not_owner: "must be the owner of the organization"
+      domain_blocked: "is a public email provider and cannot be claimed by an organization"
+      join_policy_invalid: "must be none, suggest or auto_join"
+      grant_one_holder: "must belong to exactly one membership or invitation"
+      grant_capabilities_blank: "must list at least one capability"
+      grant_capabilities_unknown: "include unknown capabilities: %{capabilities}"
       pending_request_taken: "already has a pending request for this organization"
       invitation_taken: "has already been invited to this organization"
       allowlist_taken: "is already on this organization's allowlist"

data/config/locales/es.yml

@@ -61,17 +61,33 @@ es:
       invite_as_owner: "No se puede invitar como propietario. Invita como administrador y transfiere la propiedad después."
       invite_not_a_member: "Solo los miembros de la organización pueden enviar invitaciones"
       invite_not_authorized: "No tienes permiso para invitar miembros"
+      invite_role_outranks_actor: "No puedes invitar a nadie como %{role} porque ese rol está por encima del tuyo"
+      invitation_management_outranks_actor: "No puedes revocar ni reenviar una invitación para el rol %{role} porque está por encima del tuyo"
 
       cannot_remove_owner: "No se puede eliminar al propietario de la organización. Transfiere la propiedad primero."
+      member_removal_outranks_actor: "No puedes eliminar a un miembro con el rol %{role} porque está por encima del tuyo"
       cannot_add_as_owner: "No se puede añadir un miembro como propietario. Usa la transferencia de propiedad."
       cannot_promote_to_owner: "No se puede ascender a propietario. Usa la transferencia de propiedad."
       cannot_demote_owner_directly: "No se puede degradar al propietario directamente. Usa la transferencia de propiedad."
       cannot_demote_owner: "No se puede degradar al propietario. Transfiere la propiedad primero."
       promote_not_higher: "No se puede ascender a %{new_role}: no es un rol superior a %{role}"
       demote_not_lower: "No se puede degradar a %{new_role}: no es un rol inferior a %{role}"
+      role_change_outranks_actor: "No puedes asignar ni retirar el rol %{role} porque está por encima del tuyo"
+      role_has_permissions_actor_lacks: "No puedes actuar sobre el rol %{role} porque tiene permisos que tú no tienes"
       transfer_no_owner: "No se puede transferir la propiedad porque la organización no tiene propietario"
       transfer_to_non_member: "No se puede transferir la propiedad a alguien que no es miembro"
       transfer_to_non_admin: "No se puede transferir la propiedad a alguien que no es administrador. Asciéndele primero."
+      transfer_personal_organization: "Una organización personal pertenece a su propietario. Conviértela primero en una organización compartida."
+      domain_operator_is_member: "Un miembro de la organización no puede aprobar su propio dominio."
+      grant_not_authorized: "No tienes permiso para gestionar el acceso a los recursos."
+      grant_outranks_actor: "No puedes gestionar el acceso de un miembro cuyo rol es superior al tuyo."
+      grant_exceeds_actor: "Solo puedes dar el acceso que tú tienes."
+      domain_verification:
+        not_started: "Inicia primero la verificación del dominio."
+        expired: "La verificación del dominio ha caducado. Iníciala de nuevo."
+        changed: "El dominio cambió durante la comprobación. Inicia la verificación de nuevo."
+        record_not_found: "No se encontró el registro DNS TXT. Los cambios de DNS pueden tardar en propagarse."
+        lookup_failed: "La consulta DNS ha fallado. Inténtalo más tarde."
 
       cannot_leave_as_last_owner: "No puedes salir de la organización siendo su único propietario. Transfiere la propiedad primero."
       cannot_leave_last_organization: "No puedes salir de tu única organización"
@@ -95,6 +111,12 @@ es:
     attributes:
       membership_taken: "ya es miembro de esta organización"
       owner_taken: "ya existe un propietario para esta organización"
+      personal_owner_not_owner: "debe ser el propietario de la organización"
+      domain_blocked: "es un proveedor de correo público y ninguna organización puede reclamarlo"
+      join_policy_invalid: "debe ser none, suggest o auto_join"
+      grant_one_holder: "debe pertenecer a una sola membresía o invitación"
+      grant_capabilities_blank: "debe indicar al menos una capacidad"
+      grant_capabilities_unknown: "incluyen capacidades desconocidas: %{capabilities}"
       pending_request_taken: "ya tiene una solicitud pendiente para esta organización"
       invitation_taken: "ya ha sido invitado a esta organización"
       allowlist_taken: "ya está en la lista de esta organización"

data/config/routes.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# rubocop:disable Metrics/BlockLength -- a routes file is one declarative block by nature
+# rubocop:disable-next Metrics/BlockLength -- a routes file is one declarative block by nature
 Organizations::Engine.routes.draw do
   # Route groups are drawn per config.engine_routes (devise_for-style
   # only:/except:) so hosts declare what they want instead of shadowing
@@ -55,4 +55,3 @@ Organizations::Engine.routes.draw do
     post "invitations/:token/accept", to: "public_invitations#accept", as: :accept_invitation
   end
 end
-# rubocop:enable Metrics/BlockLength

data/gemfiles/rails_7.2.gemfile

@@ -8,7 +8,7 @@ gem "json", "< 3"
 
 group :development do
   gem "irb"
-  gem "rubocop", "~> 1.88"
+  gem "rubocop", "~> 1.92"
   gem "rubocop-minitest", "~> 0.39"
   gem "rubocop-performance", "~> 1.26"
 end
@@ -19,8 +19,12 @@ group :development, :test do
   gem "minitest-mock"
   gem "rack-test"
   gem "sqlite3", ">= 2.1"
+  gem "pg"
   gem "ostruct"
   gem "simplecov", require: false
+  gem "activejob", ">= 7.1.0", "< 9.0"
+  gem "actionmailer", ">= 7.1.0", "< 9.0"
+  gem "globalid", ">= 1.0"
 end
 
 gemspec path: "../"

data/gemfiles/rails_8.1.gemfile

@@ -7,7 +7,7 @@ gem "rails", "~> 8.1.2"
 
 group :development do
   gem "irb"
-  gem "rubocop", "~> 1.88"
+  gem "rubocop", "~> 1.92"
   gem "rubocop-minitest", "~> 0.39"
   gem "rubocop-performance", "~> 1.26"
 end
@@ -18,8 +18,12 @@ group :development, :test do
   gem "minitest-mock"
   gem "rack-test"
   gem "sqlite3", ">= 2.1"
+  gem "pg"
   gem "ostruct"
   gem "simplecov", require: false
+  gem "activejob", ">= 7.1.0", "< 9.0"
+  gem "actionmailer", ">= 7.1.0", "< 9.0"
+  gem "globalid", ">= 1.0"
 end
 
 gemspec path: "../"

data/lib/generators/organizations/grants/grants_generator.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+require "rails/generators/active_record"
+
+module Organizations
+  module Generators
+    # Adds the table for scoped resource grants (optional feature):
+    #
+    #   rails g organizations:grants
+    #   rails db:migrate
+    #
+    # Then include Organizations::Grantable in the models you grant, and use
+    # membership.grant!, membership.can? and Model.visible_to(membership).
+    class GrantsGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+
+      source_root File.expand_path("templates", __dir__)
+      desc "Add the organizations_grants table (scoped resource grants)"
+
+      def self.next_migration_number(dir)
+        ActiveRecord::Generators::Base.next_migration_number(dir)
+      end
+
+      def create_migration_file
+        migration_template "create_organizations_grants.rb.erb",
+                           File.join(db_migrate_path, "create_organizations_grants.rb"),
+                           migration_version: migration_version
+      end
+
+      def display_post_install_message
+        say "\n✅ organizations grants migration created.", :green
+        say "\nNext steps:"
+        say "  1. Check the type of grantable_id in the migration (it must match your resources' ids)."
+        say "  2. Run 'rails db:migrate'."
+        say "  3. Add `include Organizations::Grantable` to the models you grant."
+        say "  4. See the README section \"Scoped resource grants\"."
+      end
+
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::STRING.to_f}]"
+      end
+    end
+  end
+end