organizations 0.6.0 → 0.7.1

data/lib/organizations/organization_scoped.rb

@@ -74,6 +74,15 @@ module Organizations
       def require_organization_role(role, **options)
         before_action(**options) { require_scoped_organization_role!(role) }
       end
+
+      # Gate actions behind a permission of the viewer's role in the URL's
+      # organization (custom roles included). Same not-found posture as
+      # require_organization_role.
+      #   require_organization_permission :invite_members
+      #   require_organization_permission :manage_settings, only: %i[verify_domain]
+      def require_organization_permission(permission, **options)
+        before_action(**options) { require_scoped_organization_permission!(permission) }
+      end
     end
 
     # The organization resolved from the URL for this request.
@@ -120,6 +129,13 @@ module Organizations
       scoped_organization_not_found!
     end
 
+    def require_scoped_organization_permission!(permission)
+      membership = current_scoped_membership
+      return if membership&.has_permission_to?(permission)
+
+      scoped_organization_not_found!
+    end
+
     def scoped_organization_not_found!
       case self.class.organization_not_found_behavior
       when :forbidden

data/lib/organizations/personal_owner_backfill.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+module Organizations
+  # Links reviewed users to their personal organizations, for installs that
+  # created personal workspaces before personal organizations existed.
+  # Called through Organizations::Organization.backfill_personal_owners!.
+  #
+  # The mapping is the only source of truth. A sole member, a name such as
+  # "Personal", or the oldest organization never proves that an organization
+  # is someone's personal workspace, and a wrong link would later let the
+  # account-deletion policy delete a one-person business.
+  class PersonalOwnerBackfill
+    # assignments - [[user_id, organization_id], ...] written (or to write, in a dry run)
+    # unchanged   - [[user_id, organization_id], ...] already linked
+    # conflicts   - [{ user_id:, organization_id:, reason: }, ...]
+    Report = Struct.new(:assignments, :unchanged, :conflicts, :applied, keyword_init: true) do
+      def applied? = applied
+    end
+
+    CONFLICT_REASONS = %i[
+      organization_not_found
+      not_the_owner
+      organization_personal_for_another_user
+      user_has_another_personal_organization
+      organization_mapped_twice
+      user_mapped_twice
+    ].freeze
+
+    def initialize(mapping)
+      user_id_type = Organizations.user_class.type_for_attribute(Organizations.user_class.primary_key)
+      organization_id_type = Organization.type_for_attribute(Organization.primary_key)
+      # Pairs, not a Hash: a record and its id are two keys for one user.
+      @pairs = mapping.map do |user, organization|
+        [user_id_type.cast(id_of(user)), organization_id_type.cast(id_of(organization))]
+      end
+    end
+
+    # @param dry_run [Boolean]
+    # @return [Report]
+    def run(dry_run: false)
+      return analyze if dry_run
+
+      apply
+    rescue ActiveRecord::RecordNotUnique
+      # A concurrent provisioning linked one of these users meanwhile. The
+      # savepoint rolled back every write; report the state as it is now.
+      analyze
+    end
+
+    private
+
+    def apply
+      report = nil
+      # SAVEPOINT: a rollback must undo only these writes, also inside a host
+      # transaction, and leave it usable on PostgreSQL.
+      Organization.transaction(requires_new: true) do
+        # Lock the organizations so the checks hold until the write.
+        Organization.where(id: @pairs.map(&:last)).order(:id).lock.to_a
+        report = analyze
+        raise ActiveRecord::Rollback unless report.conflicts.empty?
+
+        report.assignments.each do |user_id, organization_id|
+          Organization.find(organization_id).update!(personal_owner_id: user_id)
+        end
+        report.applied = true
+      end
+      report
+    end
+
+    def analyze
+      load_lookups
+      report = Report.new(assignments: [], unchanged: [], conflicts: [], applied: false)
+      @pairs.each do |user_id, organization_id|
+        reason = conflict_for(user_id, organization_id)
+        if reason
+          report.conflicts << { user_id: user_id, organization_id: organization_id, reason: reason }
+        elsif @linked[user_id] == organization_id
+          report.unchanged << [user_id, organization_id]
+        else
+          report.assignments << [user_id, organization_id]
+        end
+      end
+      report
+    end
+
+    # One query per rule, for the whole mapping.
+    def load_lookups
+      user_ids = @pairs.map(&:first)
+      organization_ids = @pairs.map(&:last)
+      @organizations = Organization.where(id: organization_ids).index_by(&:id)
+      @owners = Membership.where(organization_id: @organizations.keys, role: "owner")
+        .pluck(:organization_id, :user_id).to_h
+      @linked = Organization.personal.where(personal_owner_id: user_ids).pluck(:personal_owner_id, :id).to_h
+      @mapped_twice = repeated(organization_ids)
+      @users_mapped_twice = repeated(user_ids)
+    end
+
+    def repeated(ids) = ids.tally.select { |_, count| count > 1 }.keys
+
+    def conflict_for(user_id, organization_id)
+      organization = @organizations[organization_id]
+      return :organization_not_found unless organization
+      return :user_mapped_twice if @users_mapped_twice.include?(user_id)
+      return :organization_mapped_twice if @mapped_twice.include?(organization_id)
+      return :not_the_owner unless @owners[organization_id] == user_id
+
+      link_conflict(user_id, organization)
+    end
+
+    def link_conflict(user_id, organization)
+      if organization.personal_owner_id.present? && organization.personal_owner_id != user_id
+        :organization_personal_for_another_user
+      elsif @linked[user_id] && @linked[user_id] != organization.id
+        :user_has_another_personal_organization
+      end
+    end
+
+    def id_of(record)
+      record.respond_to?(:id) ? record.id : record
+    end
+  end
+end

data/lib/organizations/public_email_domains.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Organizations
+  # Common free email providers, for config.blocked_email_domains. Opt-in:
+  #
+  #   config.blocked_email_domains = Organizations::PUBLIC_EMAIL_DOMAINS
+  #   config.blocked_email_domains = Organizations::PUBLIC_EMAIL_DOMAINS + ["example-isp.net"]
+  #
+  # Defence in depth, not proof of authority and not a complete list: the
+  # proof is the DNS challenge. A blocked domain cannot be enrolled and never
+  # admits through a domain. People with these addresses can still join by
+  # invitation, code or allowlist.
+  PUBLIC_EMAIL_DOMAINS = %w[
+    aol.com
+    fastmail.com
+    gmail.com
+    gmx.com
+    gmx.de
+    gmx.net
+    googlemail.com
+    hey.com
+    hotmail.co.uk
+    hotmail.com
+    hotmail.es
+    hotmail.fr
+    icloud.com
+    live.com
+    mac.com
+    mail.com
+    mail.ru
+    me.com
+    msn.com
+    outlook.com
+    outlook.es
+    pm.me
+    proton.me
+    protonmail.com
+    qq.com
+    tutanota.com
+    web.de
+    yahoo.co.uk
+    yahoo.com
+    yahoo.es
+    yahoo.fr
+    yandex.com
+    yandex.ru
+    zoho.com
+  ].freeze
+end

data/lib/organizations/resource.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Organizations
+  # A resource of the host app named by type and id, for grants on records
+  # that are not ActiveRecord models (or that you do not want to load):
+  #
+  #   entity = Organizations::Resource.new("Ledger::Entity", entity_id)
+  #   membership.grant!(entity, capabilities: %w[read])
+  #   membership.can?(:read, entity)
+  Resource = Data.define(:type, :id)
+end

data/lib/organizations/roles.rb

@@ -124,6 +124,52 @@ module Organizations
         idx_a < idx_b ? -1 : 1
       end
 
+      # Check if an account holding actor_role may act on role: give it to a
+      # member, take it away, remove a member who holds it, or invite to it.
+      # See assignment_refusal for the rule.
+      # @param actor_role [Symbol, String] The role of the account making the change
+      # @param role [Symbol, String] The role being acted on
+      # @return [Boolean]
+      #
+      # @example
+      #   Roles.can_assign?(:admin, :admin)  # => true (same rank)
+      #   Roles.can_assign?(:admin, :member) # => true
+      #   Roles.can_assign?(:member, :admin) # => false (admin ranks above member)
+      #
+      def can_assign?(actor_role, role) = assignment_refusal(actor_role, role).nil?
+
+      # Why an account holding actor_role may not act on role, or nil when it
+      # may. A role acts only on roles at or below its own rank, so a custom
+      # role that can edit member roles still cannot create or demote an
+      # admin. Rank alone is not enough below admin: two custom roles with the
+      # same parent are ranked by definition order, so a role below admin may
+      # also act only on roles whose permissions it holds itself. Admins and
+      # the owner keep the rank rule alone, as before. A role that is no
+      # longer configured ranks below every configured role and has no
+      # permissions; an actor whose own role is no longer configured may act
+      # on nothing. The owner role keeps its own rules on top of this: it
+      # moves only through transfer_ownership_to!.
+      # @param actor_role [Symbol, String] The role of the account making the change
+      # @param role [Symbol, String] The role being acted on
+      # @return [nil, :outranks, :lacks_permissions]
+      #
+      # @example
+      #   Roles.assignment_refusal(:member, :admin)  # => :outranks
+      #   Roles.assignment_refusal(:lead, :finance)  # => :lacks_permissions (a sibling with other powers)
+      #   Roles.assignment_refusal(:lead, :member)   # => nil
+      #
+      def assignment_refusal(actor_role, role)
+        return :outranks if actor_role.nil? || role.nil?
+
+        current = snapshot # one snapshot for the ranks and the permissions
+        actor_role = actor_role.to_sym
+        role = role.to_sym
+        return :outranks unless ranks_at_or_above?(current.hierarchy, actor_role, role)
+        return nil if ranks_at_or_above?(current.hierarchy, actor_role, :admin)
+
+        holds_permissions_of?(current.permission_sets, actor_role, role) ? nil : :lacks_permissions
+      end
+
       # Get all permissions for a role (pre-computed, O(1) lookup)
       # @param role [Symbol, String] The role
       # @return [Array<Symbol>] All permissions for the role
@@ -206,6 +252,15 @@ module Organizations
 
       private
 
+      # A role missing from order ranks below every configured role; an actor
+      # missing from it ranks at or above nothing.
+      def ranks_at_or_above?(order, actor_role, role)
+        actor_rank = order.index(actor_role)
+        !actor_rank.nil? && actor_rank <= (order.index(role) || order.length)
+      end
+
+      def holds_permissions_of?(sets, actor_role, role) = (sets[role] || Set.new).subset?(sets[actor_role] || Set.new)
+
       # The hierarchy and permissions of one roles definition, computed
       # together and published as one immutable value. It belongs to the
       # definition object it was built from: after a reconfiguration (or a

data/lib/organizations/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Organizations
-  VERSION = "0.6.0"
+  VERSION = "0.7.1"
 end

data/lib/organizations/view_helpers.rb

@@ -95,32 +95,36 @@ module Organizations
 
     # Returns a human-readable role label
     # @param role [Symbol, String] The role
+    # @param organization [Organizations::Organization, nil] pass it to use
+    #   that organization's vocabulary (config.vocabulary); never inferred
     # @return [String]
     #
     # @example
     #   organization_role_label(:admin) # => "Admin"
+    #   organization_role_label(:member, organization: school) # => "Student"
     #
-    def organization_role_label(role)
+    def organization_role_label(role, organization: nil)
       # I18n-backed (organizations.roles.*) so hosts localize/retheme labels
       # by overriding locale keys instead of monkey-patching this helper.
       # Custom roles defined via config.roles fall back to humanize unless
       # the host adds a matching organizations.roles.<name> key.
-      Organizations.t(:"roles.#{role}", default: role.to_s.humanize)
+      Organizations.t(:"roles.#{role}", organization: organization, default: role.to_s.humanize)
     end
 
     # Returns a hash of role information for building badges
     # @param role [Symbol, String] The role
+    # @param organization [Organizations::Organization, nil] for its vocabulary
     # @return [Hash] Hash with :role, :label, and :color keys
     #
     # @example
     #   organization_role_info(:admin)
     #   # => { role: :admin, label: "Admin", color: :blue }
     #
-    def organization_role_info(role)
+    def organization_role_info(role, organization: nil)
       role_sym = role.to_sym
       {
         role: role_sym,
-        label: organization_role_label(role_sym),
+        label: role_label_for(role_sym, organization),
         color: role_color(role_sym)
       }
     end
@@ -172,8 +176,8 @@ module Organizations
           name: user.respond_to?(:name) && user.name.present? ? user.name : user.email,
           email: user.email,
           role: membership.role.to_sym,
-          role_label: organization_role_label(membership.role),
-          role_info: organization_role_info(membership.role),
+          role_label: role_label_for(membership.role, organization),
+          role_info: organization_role_info(membership.role, organization: organization),
           joined_at: membership.created_at,
           is_owner: membership.owner?
         }
@@ -190,7 +194,7 @@ module Organizations
           id: invitation.id,
           email: invitation.email,
           role: invitation.role.to_sym,
-          role_label: organization_role_label(invitation.role),
+          role_label: role_label_for(invitation.role, organization),
           invited_by: inviter,
           invited_by_name: inviter_display_name(inviter),
           status: organization_invitation_status(invitation),
@@ -240,6 +244,8 @@ module Organizations
     end
 
     # Check if current user can remove a member
+    # Follows the same rule as Organization#remove_member!: the member's role
+    # must be one the user may act on (see Roles.assignment_refusal).
     # @param user [User] The user performing the action
     # @param membership [Organizations::Membership] The membership to remove
     # @return [Boolean]
@@ -247,10 +253,12 @@ module Organizations
       return false unless user_has_permission_in_org?(user, membership.organization, :remove_members)
       return false if membership.owner? # Can't remove owner
 
-      true
+      user_can_act_on_role?(user, membership)
     end
 
     # Check if current user can change a member's role
+    # Follows the same rule as Organization#change_role_of!: the member's
+    # current role must be one the user may act on (see Roles.assignment_refusal).
     # @param user [User] The user performing the action
     # @param membership [Organizations::Membership] The membership to update
     # @return [Boolean]
@@ -262,7 +270,7 @@ module Organizations
       if membership.owner?
         user_has_permission_in_org?(user, membership.organization, :transfer_ownership)
       else
-        true
+        user_can_act_on_role?(user, membership)
       end
     end
 
@@ -353,6 +361,24 @@ module Organizations
       end
     end
 
+    # organization_role_label with the organization, unless a host override
+    # of it takes only the role (written before 0.7.0).
+    def role_label_for(role, organization)
+      if role_label_takes_organization?
+        organization_role_label(role, organization: organization)
+      else
+        organization_role_label(role)
+      end
+    end
+
+    def role_label_takes_organization?
+      return @_role_label_takes_organization if defined?(@_role_label_takes_organization)
+
+      @_role_label_takes_organization = method(:organization_role_label).parameters.any? do |kind, name|
+        kind == :keyrest || name == :organization
+      end
+    end
+
     def role_color(role)
       case role.to_sym
       when :owner then :purple
@@ -379,6 +405,11 @@ module Organizations
       role && Roles.has_permission?(role, permission)
     end
 
+    def user_can_act_on_role?(user, membership)
+      role = user.role_in(membership.organization)
+      role.present? && Roles.can_assign?(role, membership.role)
+    end
+
     # Returns display name for invitation sender (handles nil inviter)
     def inviter_display_name(inviter)
       return nil unless inviter

data/lib/organizations.rb

@@ -71,6 +71,20 @@ module Organizations
     end
   end
 
+  # Domain authority: why a DNS verification failed. reason is one of
+  # :not_started, :expired, :changed (the claim changed during the check),
+  # :record_not_found, :lookup_failed.
+  class DomainVerificationFailed < Error
+    REASONS = %i[not_started expired changed record_not_found lookup_failed].freeze
+
+    attr_reader :reason
+
+    def initialize(reason)
+      @reason = reason
+      super(Organizations.t(:"errors.domain_verification.#{reason}"))
+    end
+  end
+
   # Join code errors (verified joining)
   # JoinCodeInvalid covers unknown, revoked, and expired codes — hosts should
   # show the same generic message for all three (don't leak which codes exist).
@@ -105,6 +119,13 @@ module Organizations
   autoload :JoinState, "organizations/join_state"
   autoload :MetadataFlags, "organizations/metadata_flags"
   autoload :OrganizationScoped, "organizations/organization_scoped"
+  autoload :PersonalOwnerBackfill, "organizations/personal_owner_backfill"
+  autoload :PUBLIC_EMAIL_DOMAINS, "organizations/public_email_domains"
+  autoload :Resource, "organizations/resource"
+  autoload :GrantHolder, "organizations/grant_holder"
+  autoload :GrantAccess, "organizations/grant_access"
+  autoload :Grantable, "organizations/grantable"
+  autoload :AccountDeletionPlan, "organizations/account_deletion_plan"
 
   # Alias for README compatibility: `include Organizations::Controller`
   Controller = ControllerHelpers
@@ -142,6 +163,7 @@ module Organizations
     autoload :JoinCode, "organizations/models/join_code"
     autoload :AllowlistEntry, "organizations/models/allowlist_entry"
     autoload :JoinRequest, "organizations/models/join_request"
+    autoload :Grant, "organizations/models/grant"
 
     # Non-Rails contexts (plain ActiveRecord, the gem's own test suite) don't
     # get the Rails engine's automatic `config/locales` pickup, so register
@@ -281,13 +303,86 @@ module Organizations
     # Hosts override any key the standard Rails way — app locale files load
     # after engine locale files, so the host's value wins.
     #
-    # @param key [String, Symbol] key under the `organizations.` scope,
+    # VOCABULARY (config.vocabulary): pass the organization record as
+    # `organization:`. When the selected vocabulary has the key
+    # (`organizations.vocabularies.<vocabulary>.<key>`, in the current locale
+    # or one of its I18n fallbacks), that translation wins. Otherwise the call
+    # is exactly the ordinary one: same key, scope, defaults and options.
+    # `%{organization}` interpolates the record's name. A String
+    # `organization:` stays a plain interpolation value, as before. Calls
+    # with an Array key or a custom `scope:` skip the vocabulary.
+    #
+    #   Organizations.t("roles.member", organization: school)  # => "Student"
+    #
+    # @param key [String, Symbol, Array] key under the `organizations.` scope,
     #   e.g. :"errors.join_code_invalid" or "roles.owner"
-    # @param options [Hash] I18n options (interpolations, :locale, :default…)
+    # @param options [Hash] I18n options (interpolations, :locale, :count,
+    #   :default…) and :organization (a record or a String)
     # @return [String]
-    def translate(key, **)
-      I18n.t(key, scope: :organizations, **)
+    def translate(key, **options)
+      # A nil organization is no organization: the ordinary call stays unchanged.
+      options = options.except(:organization) if options.key?(:organization) && options[:organization].nil?
+      record = options[:organization].is_a?(Organizations::Organization) ? options[:organization] : nil
+      options = options.merge(organization: record.name) if record
+      vocabulary_key = vocabulary_key_for(key, record, options)
+      # The vocabulary key exists, so the caller's default (meant for the
+      # ordinary key) does not apply.
+      return I18n.t(vocabulary_key, scope: :organizations, **options.except(:default)) if vocabulary_key
+
+      I18n.t(key, scope: :organizations, **options)
     end
+
+    # The I18n lookup chain for a key, most specific first: the vocabulary
+    # key (when config.vocabulary selects one for this organization), then
+    # the ordinary key. Absolute keys, for the Rails `t` view helper (needed
+    # for `_html` keys):
+    #
+    #   primary, *fallbacks = Organizations.i18n_keys(:"mailers.invitation.invited_by_html", organization: org)
+    #   t(primary, default: fallbacks, inviter: name, organization: org.name)
+    #
+    # @param key [String, Symbol]
+    # @param organization [Organizations::Organization, nil]
+    # @return [Array<Symbol>]
+    def i18n_keys(key, organization: nil)
+      ordinary = :"organizations.#{key}"
+      vocabulary = vocabulary_for(organization)
+      vocabulary ? [:"organizations.vocabularies.#{vocabulary}.#{key}", ordinary] : [ordinary]
+    end
+
+    # @api private
+    # The vocabulary key to use for this call, or nil for the ordinary call.
+    def vocabulary_key_for(key, record, options)
+      return nil if key.is_a?(Array) || options.key?(:scope)
+
+      vocabulary = vocabulary_for(record)
+      return nil unless vocabulary
+
+      candidate = :"vocabularies.#{vocabulary}.#{key}"
+      I18n.exists?(candidate, scope: :organizations, locale: options[:locale] || I18n.locale) ? candidate : nil
+    end
+
+    # The vocabulary config.vocabulary selects: a Symbol/String for the whole
+    # app, or a callable that receives the organization (never called
+    # without one). nil selects the ordinary translations.
+    # @param organization [Organizations::Organization, nil]
+    # @return [String, nil]
+    # A resolver that raises, or returns a name that is not one plain label
+    # (letters, digits, underscores), selects the ordinary translations and
+    # logs a warning: wording must never break a page or an email.
+    def vocabulary_for(organization)
+      setting = configuration.vocabulary
+      setting = organization ? setting.call(organization) : nil if setting.respond_to?(:call)
+      name = setting.to_s.presence
+      return nil unless name
+      return name if name.match?(/\A[a-z0-9_]+\z/i)
+
+      Callbacks.log_warn("[Organizations] Ignored vocabulary #{name.inspect}: use letters, digits and underscores")
+      nil
+    rescue StandardError => e
+      Callbacks.log_warn("[Organizations] The vocabulary resolver failed: #{e.class}: #{e.message}")
+      nil
+    end
+
     alias t translate
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: organizations
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.1
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-10-17 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -101,6 +101,7 @@ files:
 - app/mailers/organizations/verification_mailer.rb
 - app/models/organizations/allowlist_entry.rb
 - app/models/organizations/domain.rb
+- app/models/organizations/grant.rb
 - app/models/organizations/invitation.rb
 - app/models/organizations/join_code.rb
 - app/models/organizations/join_request.rb
@@ -120,9 +121,20 @@ files:
 - docs/organizations-team-members.webp
 - gemfiles/rails_7.2.gemfile
 - gemfiles/rails_8.1.gemfile
+- lib/generators/organizations/grants/grants_generator.rb
+- lib/generators/organizations/grants/templates/create_organizations_grants.rb.erb
 - lib/generators/organizations/install/install_generator.rb
 - lib/generators/organizations/install/templates/create_organizations_tables.rb.erb
 - lib/generators/organizations/install/templates/initializer.rb
+- lib/generators/organizations/join/join_generator.rb
+- lib/generators/organizations/join/templates/app/controllers/organization_access_controller.rb
+- lib/generators/organizations/join/templates/app/controllers/organization_joins_controller.rb
+- lib/generators/organizations/join/templates/app/views/organization_access/show.html.erb
+- lib/generators/organizations/join/templates/app/views/organization_joins/_disclosure.html.erb
+- lib/generators/organizations/join/templates/app/views/organization_joins/show.html.erb
+- lib/generators/organizations/join/templates/routes.rb
+- lib/generators/organizations/upgrade/templates/add_domain_verification.rb.erb
+- lib/generators/organizations/upgrade/templates/add_personal_organizations.rb.erb
 - lib/generators/organizations/upgrade/templates/add_verified_joining_to_organizations.rb.erb
 - lib/generators/organizations/upgrade/upgrade_generator.rb
 - lib/generators/organizations/views/templates/organizations/invitations/_form.html.erb
@@ -137,6 +149,7 @@ files:
 - lib/generators/organizations/views/templates/organizations/organizations/show.html.erb
 - lib/generators/organizations/views/views_generator.rb
 - lib/organizations.rb
+- lib/organizations/account_deletion_plan.rb
 - lib/organizations/acts_as_tenant_integration.rb
 - lib/organizations/callback_context.rb
 - lib/organizations/callbacks.rb
@@ -145,6 +158,9 @@ files:
 - lib/organizations/current_user_resolution.rb
 - lib/organizations/email_normalizer.rb
 - lib/organizations/engine.rb
+- lib/organizations/grant_access.rb
+- lib/organizations/grant_holder.rb
+- lib/organizations/grantable.rb
 - lib/organizations/invitation_acceptance_failure.rb
 - lib/organizations/invitation_acceptance_result.rb
 - lib/organizations/join_flow.rb
@@ -153,12 +169,16 @@ files:
 - lib/organizations/models/allowlist_entry.rb
 - lib/organizations/models/concerns/has_organizations.rb
 - lib/organizations/models/domain.rb
+- lib/organizations/models/grant.rb
 - lib/organizations/models/invitation.rb
 - lib/organizations/models/join_code.rb
 - lib/organizations/models/join_request.rb
 - lib/organizations/models/membership.rb
 - lib/organizations/models/organization.rb
 - lib/organizations/organization_scoped.rb
+- lib/organizations/personal_owner_backfill.rb
+- lib/organizations/public_email_domains.rb
+- lib/organizations/resource.rb
 - lib/organizations/roles.rb
 - lib/organizations/test_helpers.rb
 - lib/organizations/version.rb