organizations 0.6.0 → 0.7.1

data/lib/organizations/configuration.rb

@@ -87,6 +87,49 @@ module Organizations
     # Can be a String or a Proc/Lambda: ->(user) { "#{user.name}'s Workspace" }
     attr_accessor :default_organization_name
 
+    # Record the auto-created organization as the user's personal
+    # organization (user.personal_organization, organization.personal?).
+    # Default false: auto-created organizations stay ordinary organizations,
+    # as before. Needs the personal_owner_id column (rails g organizations:upgrade).
+    attr_accessor :record_personal_organizations
+
+    # What happens when a user who owns organizations is deleted:
+    #   :prevent (default)              - any owned organization blocks the deletion
+    #   :destroy_personal_organization  - the user's personal organization is
+    #     deleted with the account when the user is its only member; any other
+    #     owned organization still blocks the deletion
+    # Preview the result with user.account_deletion_plan.
+    attr_reader :account_deletion_policy
+
+    def account_deletion_policy=(value)
+      @account_deletion_policy = value.is_a?(String) ? value.to_sym : value
+    end
+
+    ACCOUNT_DELETION_POLICIES = %i[prevent destroy_personal_organization].freeze
+
+    # === Vocabulary (v0.7.0) ===
+    # Organization-specific wording, display text only. nil (default) keeps
+    # the ordinary translations. A Symbol/String selects one vocabulary for
+    # the whole app; a callable receives the organization:
+    #   config.vocabulary = :classroom
+    #   config.vocabulary = ->(organization) { organization.metadata["vocabulary"] }
+    # Translations live under organizations.vocabularies.<name>.* in your
+    # locale files; a missing key falls back to the ordinary one.
+    attr_accessor :vocabulary
+
+    # === Scoped resource grants (v0.7.0) ===
+    # Roles at or above this one see every resource; roles below it see only
+    # the resources granted to them. nil = grants limit every role.
+    attr_accessor :full_resource_access_role
+
+    # The capability names a grant may list (nil = any name).
+    #   config.grant_capabilities = %i[read edit approve]
+    attr_accessor :grant_capabilities
+
+    # The permission a member needs to grant or revoke (default
+    # :edit_member_roles). Checked when granted_by:/revoked_by: is a member.
+    attr_accessor :grant_management_permission
+
     # === Invitations ===
     # How long invitations are valid
     attr_accessor :invitation_expiry
@@ -124,6 +167,31 @@ module Organizations
     # inbox control, skipping the emailed code when the domain matches.
     attr_accessor :trust_confirmed_account_email
 
+    # === Domain authority (v0.7.0) ===
+    # Admit through a domain only when the organization proved control of it
+    # (DNS TXT record or operator approval). Default false: unverified domains
+    # keep working as before. Turn it on BEFORE you let untrusted organizers
+    # enroll domains themselves.
+    attr_accessor :require_verified_domains
+
+    # The DNS label of the TXT record: "_organizations-verification" makes
+    # the record "_organizations-verification.acme.com". Use your brand.
+    attr_accessor :domain_verification_record_prefix
+
+    # How long a DNS challenge stays open after start_verification!
+    attr_accessor :domain_verification_ttl
+
+    # Seconds the default resolver waits for a DNS answer
+    attr_accessor :domain_verification_timeout
+
+    # Custom TXT lookup: ->(record_name) { ["value", ...] }. nil = Resolv.
+    attr_accessor :domain_txt_resolver
+
+    # Email domains that can never be enrolled or admit through a domain,
+    # such as Organizations::PUBLIC_EMAIL_DOMAINS. Default: none. Invitations
+    # and allowlist joins are not affected.
+    attr_accessor :blocked_email_domains
+
     # How long join requests stay pending before they read as expired
     # (derived status, like invitations). nil = never expire.
     attr_accessor :join_request_expiry
@@ -209,6 +277,7 @@ module Organizations
       @engine_routes = value.nil? ? nil : normalize_engine_routes(value)
     end
 
+    # @api private
     # The resolved set of enabled groups.
     # @return [Array<Symbol>]
     def engine_route_groups
@@ -269,6 +338,12 @@ module Organizations
       # Auto-creation defaults
       @always_create_personal_organization_for_each_user = false
       @default_organization_name = "Personal"
+      @record_personal_organizations = false
+      @vocabulary = nil
+      @full_resource_access_role = :admin
+      @grant_capabilities = nil
+      @grant_management_permission = :edit_member_roles
+      @account_deletion_policy = :prevent
 
       # Invitation defaults
       @invitation_expiry = 7.days
@@ -286,6 +361,14 @@ module Organizations
       @join_request_expiry = 30.days
       @join_code_generator = nil
 
+      # Domain authority defaults
+      @require_verified_domains = false
+      @domain_verification_record_prefix = "_organizations-verification"
+      @domain_verification_ttl = 7.days
+      @domain_verification_timeout = 5
+      @domain_txt_resolver = nil
+      @blocked_email_domains = []
+
       # Limits
       @max_organizations_per_user = nil
 
@@ -500,6 +583,7 @@ module Organizations
       end
     end
 
+    # @api private
     # Normalize an email through the configured (or default) normalizer
     # @param email [String, nil]
     # @return [String] normalized email
@@ -510,6 +594,14 @@ module Organizations
       EmailNormalizer.normalize(email)
     end
 
+    # @api private
+    # The blocked email domains, lowercased.
+    # @return [Array<String>]
+    def normalized_blocked_email_domains
+      Array(@blocked_email_domains).map { |d| d.to_s.strip.downcase.delete_prefix("@") }
+    end
+
+    # @api private
     # Resolve the default organization name for a user
     # @param user [Object] The user object
     # @return [String] The organization name
@@ -528,8 +620,12 @@ module Organizations
     # @raise [ConfigurationError] if configuration is invalid
     def validate!
       validate_authentication_methods!
+      validate_personal_organization_settings!
+      validate_vocabulary!
+      validate_grant_settings!
       validate_invitation_settings!
       validate_verification_settings!
+      validate_domain_authority_settings!
       validate_limits!
       validate_invitation_redirects!
       validate_no_organization_messages!
@@ -553,6 +649,44 @@ module Organizations
       end
     end
 
+    def validate_grant_settings!
+      validate_full_resource_access_role!
+      validate_grant_capabilities!
+      return if @grant_management_permission.is_a?(Symbol) || @grant_management_permission.is_a?(String)
+
+      raise ConfigurationError, "grant_management_permission must be a Symbol"
+    end
+
+    def validate_full_resource_access_role!
+      return if @full_resource_access_role.nil?
+      return if Roles.hierarchy_for(@custom_roles_definition).include?(@full_resource_access_role.to_sym)
+
+      raise ConfigurationError, "full_resource_access_role must be nil or a configured role"
+    end
+
+    def validate_grant_capabilities!
+      return if @grant_capabilities.nil?
+      return if @grant_capabilities.is_a?(Array) && @grant_capabilities.all? { |c| c.is_a?(String) || c.is_a?(Symbol) }
+
+      raise ConfigurationError, "grant_capabilities must be nil or an Array of Symbols/Strings"
+    end
+
+    def validate_vocabulary!
+      return if @vocabulary.nil? || @vocabulary.is_a?(Symbol) || @vocabulary.is_a?(String) || @vocabulary.respond_to?(:call)
+
+      raise ConfigurationError, "vocabulary must be nil, a Symbol, a String, or callable (receives the organization)"
+    end
+
+    def validate_personal_organization_settings!
+      unless [true, false].include?(@record_personal_organizations)
+        raise ConfigurationError, "record_personal_organizations must be true or false"
+      end
+
+      return if ACCOUNT_DELETION_POLICIES.include?(@account_deletion_policy)
+
+      raise ConfigurationError, "account_deletion_policy must be one of: #{ACCOUNT_DELETION_POLICIES.join(', ')}"
+    end
+
     def validate_invitation_settings!
       unless @invitation_expiry.nil? || @invitation_expiry.is_a?(ActiveSupport::Duration) || @invitation_expiry.is_a?(Numeric)
         raise ConfigurationError, "invitation_expiry must be a Duration (e.g., 7.days) or nil"
@@ -581,6 +715,24 @@ module Organizations
       raise ConfigurationError, "join_request_expiry must be a Duration (e.g., 30.days), Numeric, or nil (never expire)"
     end
 
+    def validate_domain_authority_settings!
+      raise ConfigurationError, "require_verified_domains must be true or false" unless [true, false].include?(@require_verified_domains)
+
+      unless @domain_verification_record_prefix.is_a?(String) && @domain_verification_record_prefix.match?(/\A_[a-z0-9-]+\z/)
+        raise ConfigurationError, "domain_verification_record_prefix must be one DNS label that starts with an underscore"
+      end
+
+      validate_duration_option!(@domain_verification_ttl, "domain_verification_ttl", "7.days")
+      unless @domain_verification_timeout.is_a?(Numeric) && @domain_verification_timeout.positive?
+        raise ConfigurationError, "domain_verification_timeout must be a positive number of seconds"
+      end
+
+      validate_callable_option!(@domain_txt_resolver, "domain_txt_resolver")
+      return if @blocked_email_domains.is_a?(Array) && @blocked_email_domains.all?(String)
+
+      raise ConfigurationError, "blocked_email_domains must be an Array of Strings"
+    end
+
     def duration_like?(value)
       value.is_a?(ActiveSupport::Duration) || value.is_a?(Numeric)
     end

data/lib/organizations/controller_helpers.rb

@@ -43,8 +43,10 @@ module Organizations
     def current_organization
       return @_current_organization if defined?(@_current_organization)
 
+      # Nothing is memoized until a user is resolved, so a read made before
+      # sign-in does not pin nil for the rest of the request.
       user = organizations_current_user
-      return @_current_organization = nil unless user
+      return nil unless user
 
       session_key = Organizations.configuration.session_key
       org_id = session[session_key]
@@ -79,7 +81,8 @@ module Organizations
       return @_current_membership if defined?(@_current_membership)
 
       user = organizations_current_user
-      return @_current_membership = nil unless user && current_organization
+      return nil unless user # not memoized, as in current_organization
+      return @_current_membership = nil unless current_organization
 
       @_current_membership = user.memberships.find_by(organization_id: current_organization.id)
     end
@@ -449,7 +452,7 @@ module Organizations
       if org
         session[session_key] = org.id
         @_current_organization = org
-        @_current_membership = nil # Clear cached membership
+        forget_current_membership!
 
         # Update user's context
         user = organizations_current_user
@@ -568,12 +571,21 @@ module Organizations
       session_key = Organizations.configuration.session_key
       session.delete(session_key)
       @_current_organization = nil
-      @_current_membership = nil
+      forget_current_membership!
 
       user = organizations_current_user
       user&.clear_organization_cache!
     end
 
+    # Drop the memoized membership so the next current_membership call reads
+    # it again for the organization that is current by then. Assigning nil
+    # would not do: current_membership memoizes nil too, so it would keep
+    # answering nil for the rest of the request, even after a switch or a
+    # fallback to another organization.
+    def forget_current_membership!
+      remove_instance_variable(:@_current_membership) if defined?(@_current_membership)
+    end
+
     def fallback_organization_for(user)
       membership = user.memberships.includes(:organization).order(updated_at: :desc, created_at: :desc).first
       membership&.organization
@@ -594,7 +606,10 @@ module Organizations
     end
 
     # Handle unauthorized access
-    def handle_unauthorized(permission: nil, required_role: nil)
+    # @param organization [Organizations::Organization, nil] the organization
+    #   the check ran against, for the message's vocabulary (default: the
+    #   current organization)
+    def handle_unauthorized(permission: nil, required_role: nil, organization: current_organization)
       config = Organizations.configuration
       user = organizations_current_user
 
@@ -613,25 +628,49 @@ module Organizations
 
       # Default behavior
       error = Organizations::NotAuthorized.new(
-        build_unauthorized_message(permission, required_role),
+        build_unauthorized_message(permission, required_role, organization),
         permission: permission,
-        organization: current_organization,
+        organization: organization,
         user: user
       )
 
       respond_to_unauthorized(error)
     end
 
-    def build_unauthorized_message(permission, required_role)
+    # Answer a NotAuthorized raised by the models, such as a role the
+    # requester may not act on, the way a failed permission guard is
+    # answered: through config.unauthorized_handler when one is set (so hosts
+    # that audit refusals there see these too, with the reason in
+    # context.metadata[:message]), otherwise with the error's message as an
+    # alert (HTML) or a 403 (JSON).
+    def handle_not_authorized(error)
+      handler = Organizations.configuration.unauthorized_handler
+      return respond_to_unauthorized(error) unless handler
+
+      context = CallbackContext.new(
+        event: :unauthorized,
+        user: organizations_current_user,
+        organization: current_organization,
+        permission: error.permission,
+        metadata: { message: error.message }
+      )
+      instance_exec(context, &handler)
+    end
+
+    # The organization is the one the check ran against (it selects the
+    # vocabulary, config.vocabulary).
+    def build_unauthorized_message(permission, required_role, organization = nil)
       if required_role
         # Same custom-role fallback as ViewHelpers#organization_role_label:
         # humanized, so "superfan" renders as "Superfan" in both places.
-        Organizations.t(:"errors.unauthorized_role",
-                        role: Organizations.t(:"roles.#{required_role}", default: required_role.to_s.humanize))
+        role = Organizations.t(:"roles.#{required_role}", organization: organization,
+                                                          default: required_role.to_s.humanize)
+        Organizations.t(:"errors.unauthorized_role", organization: organization, role: role)
       elsif permission
-        Organizations.t(:"errors.unauthorized_permission", permission: permission.to_s.humanize.downcase)
+        Organizations.t(:"errors.unauthorized_permission", organization: organization,
+                                                           permission: permission.to_s.humanize.downcase)
       else
-        Organizations.t(:"errors.unauthorized")
+        Organizations.t(:"errors.unauthorized", organization: organization)
       end
     end
 
@@ -804,10 +843,11 @@ module Organizations
     end
 
     def default_pending_invitation_acceptance_notice(result)
-      organization_name = result.invitation.organization.name
-      return Organizations.t(:"notices.already_member", organization: organization_name) if result.already_member?
+      # The record: its name fills %{organization}, and it selects its vocabulary.
+      organization = result.invitation.organization
+      return Organizations.t(:"notices.already_member", organization: organization) if result.already_member?
 
-      Organizations.t(:"notices.welcome", organization: organization_name)
+      Organizations.t(:"notices.welcome", organization: organization)
     end
   end
 end

data/lib/organizations/grant_access.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Organizations
+  # What a membership may do with the resources of the host app (scoped
+  # resource grants). Included in Membership.
+  module GrantAccess
+    # Whether grants limit this membership: its role ranks below
+    # config.full_resource_access_role (:admin by default). A limited member
+    # sees only the resources granted to it.
+    # @return [Boolean]
+    def limited_by_grants?
+      full_access_role = Organizations.configuration.full_resource_access_role
+      full_access_role.nil? || !Roles.at_least?(role_sym, full_access_role)
+    end
+
+    # The capabilities this member has on a resource: its role's permissions,
+    # narrowed by the grant when grants limit it. A grant never widens the
+    # role.
+    # @param resource [ActiveRecord::Base, Organizations::Resource, #id]
+    # @return [Set<Symbol>]
+    def capabilities_for(resource)
+      owner_id = Organizations::Grant.resource_organization_id(resource)
+      return Set.new if owner_id && owner_id != organization_id
+
+      permitted = Roles.permissions_for(role_sym).to_set
+      return permitted unless limited_by_grants?
+
+      granted = grant_for(resource)&.capabilities&.map(&:to_sym) || []
+      permitted & granted
+    end
+
+    # @param capability [Symbol, String]
+    # @param resource [ActiveRecord::Base, Organizations::Resource, #id]
+    # @return [Boolean]
+    #
+    # @example
+    #   membership.can?(:edit, document)
+    def can?(capability, resource)
+      capabilities_for(resource).include?(capability.to_sym)
+    end
+
+    # The records of a relation this member may see: all of them when
+    # grants do not limit it, else the granted ones. With capability:, only
+    # where it holds that capability (and its role has it).
+    # @param relation [ActiveRecord::Relation]
+    # @param capability [Symbol, String, nil]
+    # @return [ActiveRecord::Relation]
+    def visible(relation, capability: nil)
+      return relation.none if capability && !has_permission_to?(capability)
+
+      # A model that belongs to organizations shows only this one's records.
+      if relation.klass.column_names.include?("organization_id")
+        relation = relation.where(organization_id: organization_id)
+      end
+      return relation unless limited_by_grants?
+
+      relation.where(relation.klass.primary_key => granted_ids(relation.klass, capability: capability))
+    end
+
+    # Ids of the granted resources of one type, where the grant gives at
+    # least one capability that the role also has.
+    # @param type [Class, String] e.g. Document or "Ledger::Entity"
+    # @param capability [Symbol, String, nil] only where the grant and the role both have it
+    # @return [Array]
+    def granted_ids(type, capability: nil)
+      permitted = Roles.permissions_for(role_sym).map(&:to_s)
+      return [] if capability && !permitted.include?(capability.to_s)
+
+      grants.of_type(type).select do |grant|
+        effective = grant.capabilities & permitted # the role is the ceiling
+        capability ? effective.include?(capability.to_s) : effective.any?
+      end.map(&:grantable_id)
+    end
+  end
+end

data/lib/organizations/grant_holder.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+module Organizations
+  # Grant management shared by Membership and Invitation (an invitation holds
+  # grants until it is accepted, then they move to the membership).
+  module GrantHolder
+    # Whether the optional grants table exists (rails g organizations:grants).
+    # @return [Boolean]
+    def self.grants_table?
+      Organizations::Grant.table_exists?
+    end
+
+    # Give access to one resource with these capabilities. Again on the same
+    # resource, it replaces the capabilities. No capabilities removes the
+    # grant (and returns nil).
+    #
+    # @param resource [ActiveRecord::Base, Organizations::Resource, #id]
+    # @param capabilities [Array<Symbol, String>]
+    # @param granted_by [User, nil] checked when it is a member of the
+    #   organization: it needs config.grant_management_permission, may act
+    #   only on roles at or below its own, and, when grants limit it, may give
+    #   only capabilities it has on that resource. An account that is not a
+    #   member is refused. nil (a console, a job, your own authorization) is
+    #   not checked.
+    # @return [Organizations::Grant, nil]
+    # @raise [Organizations::NotAuthorized]
+    # @raise [ArgumentError] when the resource belongs to another organization
+    def grant!(resource, capabilities:, granted_by: nil)
+      ensure_resource_in_organization!(resource)
+      capabilities = Array(capabilities).map { |c| c.to_s.strip }.compact_blank.uniq
+      authorize_grant!(resource, capabilities, granted_by)
+      if capabilities.empty?
+        destroy_grants_on(resource)
+        return nil
+      end
+
+      upsert_grant!(*Organizations::Grant.resource_key(resource), capabilities, granted_by)
+    end
+
+    # Remove the grant on a resource, if any.
+    # @param resource [ActiveRecord::Base, Organizations::Resource, #id]
+    # @param revoked_by [User, nil] checked like granted_by in grant!
+    # @return [self]
+    def revoke_grant!(resource, revoked_by: nil)
+      authorize_grant!(resource, [], revoked_by)
+      destroy_grants_on(resource)
+    end
+
+    # @api private
+    # Check grants before they are written (an invitation checks them before
+    # it is saved). Same rules as grant!.
+    # @param grants [Array<Array(resource, capabilities)>]
+    # @param actor [User, nil]
+    # @raise [Organizations::NotAuthorized]
+    def authorize_grants!(grants, actor)
+      grants.each do |resource, capabilities|
+        ensure_resource_in_organization!(resource)
+        authorize_grant!(resource, Array(capabilities).map(&:to_s), actor)
+      end
+    end
+
+    # @param resource [ActiveRecord::Base, Organizations::Resource, #id]
+    # @return [Organizations::Grant, nil]
+    # Reads preloaded grants (`includes(:grants)`, `grants.load`) without a
+    # query, so a list of records can be checked cheaply.
+    def grant_for(resource)
+      return grants.for_resource(resource).first unless grants.loaded?
+
+      type, id = Organizations::Grant.resource_key(resource)
+      grants.find { |grant| grant.grantable_type == type && grant.grantable_id == id }
+    end
+
+    # @param resource [ActiveRecord::Base, Organizations::Resource, #id]
+    # @return [Boolean] whether a grant on the resource exists
+    def granted?(resource)
+      grants.for_resource(resource).exists?
+    end
+
+    private
+
+    def destroy_grants_on(resource)
+      grants.for_resource(resource).destroy_all
+      grants.reset
+      self
+    end
+
+    def upsert_grant!(type, id, capabilities, granted_by)
+      # SAVEPOINT: the unique-index race below must stay rescuable inside a
+      # host transaction on PostgreSQL.
+      ActiveRecord::Base.transaction(requires_new: true) do
+        lock_for_grant_write!
+        grant = grants.find_or_initialize_by(grantable_type: type, grantable_id: id)
+        grant.update!(capabilities: capabilities, granted_by_id: granted_by&.id || grant.granted_by_id)
+        grant
+      end
+    rescue ActiveRecord::RecordNotUnique
+      # A concurrent grant! on the same resource won; apply ours on top.
+      grants.reset
+      grant = grants.find_by!(grantable_type: type, grantable_id: id)
+      grant.update!(capabilities: capabilities)
+      grant
+    end
+
+    # A resource that belongs to an organization (organization_id, also
+    # when named by an Organizations::Resource of such a model) must belong
+    # to this one.
+    def ensure_resource_in_organization!(resource)
+      owner_id = Organizations::Grant.resource_organization_id(resource)
+      return if owner_id.nil? || owner_id == organization_id
+
+      raise ArgumentError, "The resource belongs to another organization"
+    end
+
+    def delete_grants
+      grants.delete_all(:delete_all) if Organizations::GrantHolder.grants_table? && persisted?
+    end
+
+    # An invitation takes grants only while it is pending (see Invitation).
+    def lock_for_grant_write!; end
+
+    def authorize_grant!(resource, capabilities, actor)
+      return unless actor
+
+      actor_membership = organization.memberships.find_by(user_id: actor.id)
+      raise_grant_refusal(:"errors.grant_not_authorized", actor, :membership) unless actor_membership
+
+      permission = Organizations.configuration.grant_management_permission
+      unless actor_membership.has_permission_to?(permission)
+        raise_grant_refusal(:"errors.grant_not_authorized", actor, permission)
+      end
+
+      Membership.authorize_rank!(organization, actor, [role], permission: permission,
+                                                              message_key: :"errors.grant_outranks_actor")
+      authorize_within_own_access!(actor_membership, resource, capabilities, actor, permission)
+    end
+
+    # A granter that grants limit too may give only access it has itself.
+    def authorize_within_own_access!(actor_membership, resource, capabilities, actor, permission)
+      return unless actor_membership.limited_by_grants?
+
+      held = actor_membership.capabilities_for(resource).map(&:to_s)
+      return if held.any? && (capabilities - held).empty?
+
+      raise_grant_refusal(:"errors.grant_exceeds_actor", actor, permission)
+    end
+
+    def raise_grant_refusal(key, actor, permission)
+      raise Organizations::NotAuthorized.new(Organizations.t(key, organization: organization),
+                                             permission: permission, organization: organization, user: actor)
+    end
+  end
+end

data/lib/organizations/grantable.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Organizations
+  # Include in a host model whose records can be granted to members:
+  #
+  #   class Document < ApplicationRecord
+  #     include Organizations::Grantable
+  #   end
+  #
+  #   Document.visible_to(membership)                     # what this member may see
+  #   Document.visible_to(membership, capability: :edit)  # …and edit
+  #   document.organization_grants                         # who has access to it
+  #
+  # Deleting a record deletes its grants.
+  module Grantable
+    extend ActiveSupport::Concern
+
+    included do
+      has_many :organization_grants, as: :grantable, class_name: "Organizations::Grant", dependent: :destroy
+
+      # Records of this model the membership may see (see Membership#visible).
+      # Chain it after your own organization scope.
+      scope :visible_to, lambda { |membership, capability: nil|
+        membership ? membership.visible(all, capability: capability) : none
+      }
+    end
+  end
+end

data/lib/organizations/join_flow.rb

@@ -84,12 +84,11 @@ module Organizations
     # Every parameter is an optional keyword with a safe default — this IS
     # the public API surface, not incidental complexity (same posture as
     # Organization#generate_join_code!).
-    # rubocop:disable Metrics/ParameterLists
+    # rubocop:disable-next Metrics/ParameterLists
     def self.attempt(user:, organization:, code: nil, email: nil, verification_code: nil, message: nil)
       new(user: user, organization: organization)
         .attempt(code: code, email: email, verification_code: verification_code, message: message)
     end
-    # rubocop:enable Metrics/ParameterLists
 
     def initialize(user:, organization:)
       @user = user
@@ -119,21 +118,26 @@ module Organizations
 
     attr_reader :user, :organization
 
+    # Verification errors and the reason each one maps to. Subclasses come
+    # before their parents; anything else is :request_closed.
+    VERIFICATION_ERROR_REASONS = {
+      Organizations::VerificationAttemptsExceeded => :verification_attempts_exceeded,
+      Organizations::VerificationCodeExpired => :verification_code_expired,
+      Organizations::VerificationCodeInvalid => :verification_code_invalid,
+      Organizations::VerificationEmailAlreadyClaimed => :email_already_claimed,
+      # The domain or roster entry stopped admitting during the challenge.
+      Organizations::VerificationEmailNotEligible => :email_not_eligible
+    }.freeze
+    private_constant :VERIFICATION_ERROR_REASONS
+
     def verify_emailed_code(typed_code)
       request = user.pending_join_request_for(organization)
       return error(:verification_code_missing, Organizations.t(:"errors.verification_code_missing")) unless request
 
       from_outcome(request.verify_email_code!(typed_code))
-    rescue Organizations::VerificationAttemptsExceeded => e
-      error(:verification_attempts_exceeded, e.message)
-    rescue Organizations::VerificationCodeExpired => e
-      error(:verification_code_expired, e.message)
-    rescue Organizations::VerificationCodeInvalid => e
-      error(:verification_code_invalid, e.message)
-    rescue Organizations::VerificationEmailAlreadyClaimed => e
-      error(:email_already_claimed, e.message)
     rescue Organizations::JoinRequestError => e
-      error(:request_closed, e.message)
+      reason = VERIFICATION_ERROR_REASONS.find { |klass, _| e.is_a?(klass) }&.last || :request_closed
+      error(reason, e.message)
     end
 
     def redeem_code(raw_code)
@@ -194,7 +198,7 @@ module Organizations
       Organizations.configuration.trust_confirmed_account_email &&
         user.respond_to?(:confirmed_at) && user.confirmed_at.present? &&
         user.respond_to?(:email) &&
-        organization.domains.matching_email(user.email).exists?
+        organization.domains.joinable.matching_email(user.email).exists?
     end
 
     def from_outcome(outcome)