@ftisindia/create-app 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ftisindia/create-app",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "One-command scaffolder for the Phase 1 NestJS foundation starter.",
   "type": "module",
   "bin": {

package/template/.env.example

@@ -21,6 +21,12 @@ AUTH_FACEBOOK_ENABLED=false
 AUTH_MOBILE_OTP_ENABLED=false
 AUTH_MAGIC_LINK_ENABLED=false
 
+CORS_ENABLED=false
+# Comma-separated exact browser origins, for example:
+# CORS_ORIGINS=http://localhost:5173,https://app.example.com
+CORS_ORIGINS=
+CORS_CREDENTIALS=false
+
 RBAC_CACHE_TTL_SECONDS=60
 # Path is the only supported mode in this starter phase.
 ORG_CONTEXT_MODE=path

package/template/README.md

@@ -78,6 +78,7 @@ GET  /auth/google
 GET  /auth/google/callback
 GET  /auth/me
 POST /organisations
+GET  /organisations/mine
 GET  /organisations/:orgId/memberships/me
 GET  /organisations/:orgId/memberships
 PATCH /organisations/:orgId/memberships/:membershipId/status
@@ -91,6 +92,7 @@ POST /organisations/:orgId/invitations/:invitationId/revoke
 POST /organisations/:orgId/invitations/:invitationId/resend
 POST /invitations/accept
 POST /invitations/decline
+GET  /organisations/:orgId/access-control/me
 GET  /organisations/:orgId/access-control/permissions
 GET  /organisations/:orgId/access-control/route-permissions
 GET  /organisations/:orgId/access-control/roles
@@ -107,6 +109,14 @@ GET  /organisations/:orgId/sample/status
 POST /organisations/:orgId/sample/echo
 ```
 
+## Frontend Bootstrap
+
+After login, call `GET /organisations/mine` to populate the organisation picker,
+store the selected `orgId`, then call
+`GET /organisations/:orgId/access-control/me`. Use the returned
+`permissionKeys` for route, menu, and button visibility in the frontend. Backend
+guards remain the source of truth for access control.
+
 ## Architecture Rules
 
 - JWTs contain identity only. Organisation membership, roles, and permissions are read per request.

package/template/src/config/app.config.ts

@@ -1,7 +1,12 @@
 import { registerAs } from '@nestjs/config';
-import { getEnv } from './env.validation';
+import { getEnv, parseCorsOrigins } from './env.validation';
 
 export default registerAs('app', () => ({
   nodeEnv: getEnv().NODE_ENV,
   port: getEnv().PORT,
+  cors: {
+    enabled: getEnv().CORS_ENABLED,
+    origins: parseCorsOrigins(getEnv().CORS_ORIGINS),
+    credentials: getEnv().CORS_CREDENTIALS,
+  },
 }));

package/template/src/config/env.validation.ts

@@ -61,10 +61,23 @@ export const envSchema = z
     AUTH_FACEBOOK_ENABLED: booleanFromEnv.default(false),
     AUTH_MOBILE_OTP_ENABLED: booleanFromEnv.default(false),
     AUTH_MAGIC_LINK_ENABLED: booleanFromEnv.default(false),
+    CORS_ENABLED: booleanFromEnv.default(false),
+    CORS_ORIGINS: z.string().trim().optional().default(''),
+    CORS_CREDENTIALS: booleanFromEnv.default(false),
     RBAC_CACHE_TTL_SECONDS: z.coerce.number().int().positive().default(60),
     ORG_CONTEXT_MODE: z.literal('path').default('path'),
   })
   .superRefine((env, ctx) => {
+    const corsOrigins = parseCorsOrigins(env.CORS_ORIGINS);
+
+    if (env.CORS_CREDENTIALS && corsOrigins.includes('*')) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['CORS_ORIGINS'],
+        message: 'CORS_ORIGINS cannot include * when CORS_CREDENTIALS=true',
+      });
+    }
+
     if (!env.AUTH_GOOGLE_ENABLED) {
       return;
     }
@@ -136,6 +149,13 @@ export function getEnv(): Env {
   return validatedEnv;
 }
 
+export function parseCorsOrigins(value: string) {
+  return value
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+}
+
 function requireHttpsInProduction(ctx: z.RefinementCtx, key: string, value: string) {
   if (new URL(value).protocol === 'https:') {
     return;

package/template/src/main.ts

@@ -8,6 +8,19 @@ import { HttpExceptionFilter } from './common/filters/http-exception.filter';
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   const config = app.get(ConfigService);
+  const cors = config.get<{
+    enabled: boolean;
+    origins: string[];
+    credentials: boolean;
+  }>('app.cors');
+
+  if (cors?.enabled) {
+    app.enableCors({
+      origin: cors.origins,
+      credentials: cors.credentials,
+    });
+  }
+
   app.enableShutdownHooks();
   app.useGlobalFilters(new HttpExceptionFilter());
 

package/template/src/modules/access-control/access-control.module.ts

@@ -7,11 +7,12 @@ import { AccessControlService } from './application/services/access-control.serv
 import { PermissionGuard } from './application/services/permission.guard';
 import { RbacCacheService } from './application/services/rbac-cache.service';
 import { AccessControlController } from './presentation/access-control.controller';
+import { CurrentAccessControlController } from './presentation/current-access-control.controller';
 
 @Global()
 @Module({
   imports: [AuthModule, DiscoveryModule],
-  controllers: [AccessControlController],
+  controllers: [AccessControlController, CurrentAccessControlController],
   providers: [
     AbilityFactory,
     AccessControlService,

package/template/src/modules/access-control/dto/current-access-control-response.dto.ts

@@ -0,0 +1,31 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { PermissionKey, permissionKeys } from '../types/permission-key';
+
+export class CurrentAccessControlResponseDto {
+  @ApiProperty({
+    example: '2c67399d-670c-4025-a5fd-1ea9a211891e',
+    format: 'uuid',
+  })
+  orgId!: string;
+
+  @ApiProperty({
+    example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
+    format: 'uuid',
+  })
+  membershipId!: string;
+
+  @ApiProperty({
+    example: 'f602c057-04f4-4ef8-8c84-1b7c62fbf8c5',
+    format: 'uuid',
+  })
+  roleId!: string;
+
+  @ApiProperty({ example: true })
+  isOwner!: boolean;
+
+  @ApiProperty({ example: true })
+  isBillingContact!: boolean;
+
+  @ApiProperty({ enum: permissionKeys, example: ['organisations.read', 'settings.read'] })
+  permissionKeys!: PermissionKey[];
+}

package/template/src/modules/access-control/presentation/current-access-control.controller.ts

@@ -0,0 +1,40 @@
+import { Controller, Get, Param, UseGuards } from '@nestjs/common';
+import { ApiBearerAuth, ApiOkResponse, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
+import { ApiProtectedErrorResponses } from '../../../common/swagger/api-error-responses';
+import { JwtAuthGuard } from '../../auth/infrastructure/passport/jwt-auth.guard';
+import { CurrentUser } from '../../auth/presentation/current-user.decorator';
+import { AuthenticatedUser } from '../../auth/types/authenticated-user';
+import { OrgScopeGuard } from '../../request-context/presentation/org-scope.guard';
+import { RbacCacheService } from '../application/services/rbac-cache.service';
+import { CurrentAccessControlResponseDto } from '../dto/current-access-control-response.dto';
+
+@ApiTags('Access control')
+@ApiBearerAuth()
+@ApiParam({ name: 'orgId', description: 'Organisation ID.', format: 'uuid' })
+@ApiProtectedErrorResponses()
+@Controller('organisations/:orgId/access-control')
+@UseGuards(JwtAuthGuard, OrgScopeGuard)
+export class CurrentAccessControlController {
+  constructor(private readonly rbacCache: RbacCacheService) {}
+
+  @Get('me')
+  @ApiOperation({
+    summary: "Return the current user's effective RBAC context for the organisation.",
+  })
+  @ApiOkResponse({
+    description: 'Effective access-control context.',
+    type: CurrentAccessControlResponseDto,
+  })
+  async me(@CurrentUser() user: AuthenticatedUser, @Param('orgId') orgId: string) {
+    const context = await this.rbacCache.getContext(user.id, orgId);
+
+    return {
+      orgId: context.orgId,
+      membershipId: context.membershipId,
+      roleId: context.roleId,
+      isOwner: context.isOwner,
+      isBillingContact: context.isBillingContact,
+      permissionKeys: context.permissionKeys,
+    };
+  }
+}

package/template/src/modules/organisations/application/services/organisations.service.ts

@@ -1,5 +1,10 @@
 import { ConflictException, Injectable } from '@nestjs/common';
-import { Prisma } from '@prisma/client';
+import { MembershipStatus, OrganisationStatus, Prisma } from '@prisma/client';
+import {
+  PaginationQueryDto,
+  resolvePageLimit,
+  toPage,
+} from '../../../../common/dto/pagination-query.dto';
 import { PrismaService } from '../../../../database/prisma/prisma.service';
 import { RequestContextService } from '../../../request-context/application/services/request-context.service';
 import { AuthenticatedUser } from '../../../auth/types/authenticated-user';
@@ -18,6 +23,67 @@ export class OrganisationsService {
     private readonly requestContext: RequestContextService,
   ) {}
 
+  async listMine(currentUser: AuthenticatedUser, query: PaginationQueryDto) {
+    const limit = resolvePageLimit(query.limit);
+
+    const rows = await this.prisma.membership.findMany({
+      where: {
+        userId: currentUser.id,
+        status: MembershipStatus.ACTIVE,
+        organisation: {
+          status: OrganisationStatus.ACTIVE,
+        },
+      },
+      select: {
+        id: true,
+        roleId: true,
+        isOwner: true,
+        isBillingContact: true,
+        organisation: {
+          select: {
+            id: true,
+            name: true,
+            slug: true,
+            status: true,
+          },
+        },
+        role: {
+          select: {
+            id: true,
+            name: true,
+            description: true,
+            isSystemSeeded: true,
+          },
+        },
+      },
+      orderBy: [{ isOwner: 'desc' }, { createdAt: 'asc' }, { id: 'asc' }],
+      take: limit + 1,
+      ...(query.cursor
+        ? {
+            cursor: { id: query.cursor },
+            skip: 1,
+          }
+        : {}),
+    });
+
+    const page = toPage(rows, limit);
+
+    return {
+      items: page.items.map((membership) => ({
+        id: membership.organisation.id,
+        name: membership.organisation.name,
+        slug: membership.organisation.slug,
+        status: membership.organisation.status,
+        membershipId: membership.id,
+        roleId: membership.roleId,
+        role: membership.role,
+        isOwner: membership.isOwner,
+        isBillingContact: membership.isBillingContact,
+      })),
+      nextCursor: page.nextCursor,
+    };
+  }
+
   async createOrganisation(currentUser: AuthenticatedUser, dto: CreateOrganisationDto) {
     const name = dto.name.trim();
     const slug = dto.slug?.trim() || (await this.createAvailableSlug(name));

package/template/src/modules/organisations/dto/organisation-response.dto.ts

@@ -1,6 +1,7 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { OrganisationStatus } from '@prisma/client';
 import { MembershipResponseDto } from '../../../common/dto/membership-response.dto';
+import { RoleSummaryDto } from '../../../common/dto/role-summary.dto';
 
 export class OrganisationResponseDto {
   @ApiProperty({
@@ -60,3 +61,53 @@ export class CreateOrganisationResponseDto {
   @ApiProperty({ type: [SeededOrganisationSettingDto] })
   settings!: SeededOrganisationSettingDto[];
 }
+
+export class MyOrganisationResponseDto {
+  @ApiProperty({
+    example: '2c67399d-670c-4025-a5fd-1ea9a211891e',
+    format: 'uuid',
+  })
+  id!: string;
+
+  @ApiProperty({ example: 'Acme Operations' })
+  name!: string;
+
+  @ApiProperty({ example: 'acme-operations' })
+  slug!: string;
+
+  @ApiProperty({ enum: OrganisationStatus, example: OrganisationStatus.ACTIVE })
+  status!: OrganisationStatus;
+
+  @ApiProperty({
+    example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
+    format: 'uuid',
+  })
+  membershipId!: string;
+
+  @ApiProperty({
+    example: 'f602c057-04f4-4ef8-8c84-1b7c62fbf8c5',
+    format: 'uuid',
+  })
+  roleId!: string;
+
+  @ApiProperty({ type: RoleSummaryDto })
+  role!: RoleSummaryDto;
+
+  @ApiProperty({ example: true })
+  isOwner!: boolean;
+
+  @ApiProperty({ example: true })
+  isBillingContact!: boolean;
+}
+
+export class MyOrganisationListResponseDto {
+  @ApiProperty({ type: [MyOrganisationResponseDto] })
+  items!: MyOrganisationResponseDto[];
+
+  @ApiProperty({
+    example: '2c67399d-670c-4025-a5fd-1ea9a211891e',
+    format: 'uuid',
+    nullable: true,
+  })
+  nextCursor!: string | null;
+}

package/template/src/modules/organisations/presentation/organisations.controller.ts

@@ -1,12 +1,22 @@
-import { Body, Controller, Post, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiCreatedResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { Body, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
+import {
+  ApiBearerAuth,
+  ApiCreatedResponse,
+  ApiOkResponse,
+  ApiOperation,
+  ApiTags,
+} from '@nestjs/swagger';
+import { PaginationQueryDto } from '../../../common/dto/pagination-query.dto';
 import { ApiErrorResponses } from '../../../common/swagger/api-error-responses';
 import { JwtAuthGuard } from '../../auth/infrastructure/passport/jwt-auth.guard';
 import { CurrentUser } from '../../auth/presentation/current-user.decorator';
 import { AuthenticatedUser } from '../../auth/types/authenticated-user';
 import { OrganisationsService } from '../application/services/organisations.service';
 import { CreateOrganisationDto } from '../dto/create-organisation.dto';
-import { CreateOrganisationResponseDto } from '../dto/organisation-response.dto';
+import {
+  CreateOrganisationResponseDto,
+  MyOrganisationListResponseDto,
+} from '../dto/organisation-response.dto';
 
 @ApiTags('Organisations')
 @ApiBearerAuth()
@@ -14,6 +24,18 @@ import { CreateOrganisationResponseDto } from '../dto/organisation-response.dto'
 export class OrganisationsController {
   constructor(private readonly organisationsService: OrganisationsService) {}
 
+  @Get('mine')
+  @UseGuards(JwtAuthGuard)
+  @ApiOperation({ summary: 'List active organisations for the current user.' })
+  @ApiOkResponse({
+    description: 'Current user organisations.',
+    type: MyOrganisationListResponseDto,
+  })
+  @ApiErrorResponses(400, 401)
+  mine(@CurrentUser() user: AuthenticatedUser, @Query() query: PaginationQueryDto) {
+    return this.organisationsService.listMine(user, query);
+  }
+
   @Post()
   @UseGuards(JwtAuthGuard)
   @ApiOperation({ summary: 'Create an organisation for the current user.' })

package/template/test/frontend-bootstrap.spec.ts

@@ -0,0 +1,181 @@
+import { MembershipStatus, OrganisationStatus } from '@prisma/client';
+import { validate, parseCorsOrigins } from '../src/config/env.validation';
+import { CurrentAccessControlController } from '../src/modules/access-control/presentation/current-access-control.controller';
+import { OrganisationsService } from '../src/modules/organisations/application/services/organisations.service';
+
+describe('frontend bootstrap endpoints', () => {
+  it('returns the current effective access-control context without internal cache fields', async () => {
+    const controller = new CurrentAccessControlController({
+      getContext: jest.fn().mockResolvedValue({
+        cacheKey: 'rbac:user-1:org-1',
+        userId: 'user-1',
+        orgId: 'org-1',
+        membershipId: 'membership-1',
+        membershipStatus: MembershipStatus.ACTIVE,
+        roleId: 'role-1',
+        isOwner: false,
+        isBillingContact: true,
+        permissionKeys: ['organisations.read'],
+      }),
+    } as never);
+
+    await expect(
+      controller.me(
+        {
+          id: 'user-1',
+          email: 'user@example.com',
+          mobile: null,
+          displayName: 'User',
+          isActive: true,
+        },
+        'org-1',
+      ),
+    ).resolves.toEqual({
+      orgId: 'org-1',
+      membershipId: 'membership-1',
+      roleId: 'role-1',
+      isOwner: false,
+      isBillingContact: true,
+      permissionKeys: ['organisations.read'],
+    });
+  });
+
+  it('queries only active current-user memberships in active organisations', async () => {
+    const prisma = {
+      membership: {
+        findMany: jest.fn().mockResolvedValue([
+          {
+            id: 'membership-1',
+            roleId: 'role-1',
+            isOwner: true,
+            isBillingContact: true,
+            organisation: {
+              id: 'org-1',
+              name: 'Acme Operations',
+              slug: 'acme',
+              status: OrganisationStatus.ACTIVE,
+            },
+            role: {
+              id: 'role-1',
+              name: 'Owner',
+              description: null,
+              isSystemSeeded: true,
+            },
+          },
+          {
+            id: 'membership-2',
+            roleId: 'role-2',
+            isOwner: false,
+            isBillingContact: false,
+            organisation: {
+              id: 'org-2',
+              name: 'Beta Operations',
+              slug: 'beta',
+              status: OrganisationStatus.ACTIVE,
+            },
+            role: {
+              id: 'role-2',
+              name: 'Viewer',
+              description: null,
+              isSystemSeeded: true,
+            },
+          },
+        ]),
+      },
+    };
+    const service = new OrganisationsService({} as never, prisma as never, {} as never);
+
+    await expect(
+      service.listMine(
+        {
+          id: 'user-1',
+          email: 'user@example.com',
+          mobile: null,
+          displayName: 'User',
+          isActive: true,
+        },
+        { limit: 1 },
+      ),
+    ).resolves.toEqual({
+      items: [
+        {
+          id: 'org-1',
+          name: 'Acme Operations',
+          slug: 'acme',
+          status: OrganisationStatus.ACTIVE,
+          membershipId: 'membership-1',
+          roleId: 'role-1',
+          role: {
+            id: 'role-1',
+            name: 'Owner',
+            description: null,
+            isSystemSeeded: true,
+          },
+          isOwner: true,
+          isBillingContact: true,
+        },
+      ],
+      nextCursor: 'membership-1',
+    });
+
+    expect(prisma.membership.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: {
+          userId: 'user-1',
+          status: MembershipStatus.ACTIVE,
+          organisation: {
+            status: OrganisationStatus.ACTIVE,
+          },
+        },
+        take: 2,
+      }),
+    );
+  });
+});
+
+describe('CORS environment config', () => {
+  it('is disabled by default', () => {
+    const env = validate(baseEnv());
+
+    expect(env.CORS_ENABLED).toBe(false);
+    expect(env.CORS_ORIGINS).toBe('');
+    expect(env.CORS_CREDENTIALS).toBe(false);
+  });
+
+  it('accepts enabled CORS with exact allowed origins', () => {
+    const env = validate({
+      ...baseEnv(),
+      CORS_ENABLED: 'true',
+      CORS_ORIGINS: 'http://localhost:5173, https://app.example.com',
+      CORS_CREDENTIALS: 'true',
+    });
+
+    expect(env.CORS_ENABLED).toBe(true);
+    expect(env.CORS_CREDENTIALS).toBe(true);
+    expect(parseCorsOrigins(env.CORS_ORIGINS)).toEqual([
+      'http://localhost:5173',
+      'https://app.example.com',
+    ]);
+  });
+
+  it('rejects wildcard origins when credentials are enabled', () => {
+    expect(() =>
+      validate({
+        ...baseEnv(),
+        CORS_ENABLED: 'true',
+        CORS_ORIGINS: '*',
+        CORS_CREDENTIALS: 'true',
+      }),
+    ).toThrow(/CORS_ORIGINS cannot include \*/u);
+  });
+});
+
+function baseEnv() {
+  return {
+    NODE_ENV: 'test',
+    PORT: '3000',
+    DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/app_test',
+    JWT_SECRET: 'test-jwt-secret-at-least-32-characters',
+    AUTH_GOOGLE_ENABLED: 'false',
+  };
+}

package/template/test/route-registry.validator.spec.ts

@@ -1,9 +1,11 @@
 import { Controller, Get } from '@nestjs/common';
 import { MetadataScanner, Reflector } from '@nestjs/core';
 import { AccessControlController } from '../src/modules/access-control/presentation/access-control.controller';
+import { CurrentAccessControlController } from '../src/modules/access-control/presentation/current-access-control.controller';
 import { RequirePermissions } from '../src/modules/access-control/presentation/permissions.decorator';
 import { RouteRegistryValidator } from '../src/modules/access-control/application/route-registry.validator';
 import { PermissionKey } from '../src/modules/access-control/types/permission-key';
+import { routePermissionRegistry } from '../src/modules/access-control/types/route-permission-registry';
 import { AuditController } from '../src/modules/audit/presentation/audit.controller';
 import { AuthController } from '../src/modules/auth/presentation/auth.controller';
 import { InvitationsController } from '../src/modules/invitations/presentation/invitations.controller';
@@ -14,6 +16,7 @@ import { SettingsController } from '../src/modules/settings/presentation/setting
 
 const controllers = [
   AccessControlController,
+  CurrentAccessControlController,
   AuditController,
   AuthController,
   InvitationsController,
@@ -28,6 +31,15 @@ describe('RouteRegistryValidator', () => {
     expect(() => createValidator(controllers).onApplicationBootstrap()).not.toThrow();
   });
 
+  it('does not register the current access-control bootstrap route as permission-gated', () => {
+    expect(routePermissionRegistry).not.toContainEqual(
+      expect.objectContaining({
+        method: 'GET',
+        path: '/organisations/:orgId/access-control/me',
+      }),
+    );
+  });
+
   it('fails when a permission-gated route is missing from the registry', () => {
     class DriftController {
       probe() {

package/template/test/security.e2e-spec.ts

@@ -72,7 +72,101 @@ describe('Security invariants (e2e)', () => {
       .expect(403);
   });
 
+  it('requires authentication for frontend bootstrap endpoints', async () => {
+    const { orgId } = await createUserAndOrg('bootstrap-auth');
+
+    await request(app.getHttpServer()).get('/organisations/mine').expect(401);
+    await request(app.getHttpServer()).get(`/organisations/${orgId}/access-control/me`).expect(401);
+  });
+
+  it('lists only active current-user organisations with cursor pagination shape', async () => {
+    const first = await createUserAndOrg('mine-active');
+    const second = await createOrganisation(first.accessToken, 'mine-suspended');
+
+    await prisma.membership.update({
+      where: { id: second.membershipId },
+      data: { status: MembershipStatus.SUSPENDED },
+    });
+
+    const response = await request(app.getHttpServer())
+      .get('/organisations/mine')
+      .set('Authorization', `Bearer ${first.accessToken}`)
+      .expect(200);
+
+    expect(response.body).toEqual({
+      items: [
+        expect.objectContaining({
+          id: first.orgId,
+          membershipId: first.membershipId,
+          roleId: expect.any(String),
+          role: expect.objectContaining({ name: 'Owner' }),
+          isOwner: true,
+          isBillingContact: true,
+        }),
+      ],
+      nextCursor: null,
+    });
+  });
+
+  it('returns effective access-control context for an active member without roles.read', async () => {
+    const owner = await createUserAndOrg('access-me-owner');
+    const member = await createMemberInOrg(owner.orgId, 'access-me-member');
+
+    const response = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/access-control/me`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .expect(200);
+
+    expect(response.body).toEqual({
+      orgId: owner.orgId,
+      membershipId: member.membershipId,
+      roleId: member.roleId,
+      isOwner: false,
+      isBillingContact: false,
+      permissionKeys: [],
+    });
+  });
+
+  it('denies access-control context to non-members', async () => {
+    const first = await createUserAndOrg('access-me-a');
+    const second = await createUserAndOrg('access-me-b');
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${second.orgId}/access-control/me`)
+      .set('Authorization', `Bearer ${first.accessToken}`)
+      .expect(403);
+  });
+
+  it.each([MembershipStatus.SUSPENDED, MembershipStatus.REVOKED])(
+    'denies access-control context for %s memberships',
+    async (status) => {
+      const owner = await createUserAndOrg(`access-me-${status.toLowerCase()}`);
+      const member = await createMemberInOrg(owner.orgId, `member-${status.toLowerCase()}`);
+
+      await prisma.membership.update({
+        where: { id: member.membershipId },
+        data: { status },
+      });
+
+      await request(app.getHttpServer())
+        .get(`/organisations/${owner.orgId}/access-control/me`)
+        .set('Authorization', `Bearer ${member.accessToken}`)
+        .expect(403);
+    },
+  );
+
   async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+
+    return {
+      ...user,
+      orgId: org.orgId,
+      membershipId: org.membershipId,
+    };
+  }
+
+  async function createUser(label: string) {
     const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const signup = await request(app.getHttpServer())
       .post('/auth/signup')
@@ -83,7 +177,14 @@ describe('Security invariants (e2e)', () => {
       })
       .expect(201);
 
-    const accessToken = signup.body.accessToken as string;
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const org = await request(app.getHttpServer())
       .post('/organisations')
       .set('Authorization', `Bearer ${accessToken}`)
@@ -94,9 +195,40 @@ describe('Security invariants (e2e)', () => {
       .expect(201);
 
     return {
-      accessToken,
       orgId: org.body.organisation.id as string,
       membershipId: org.body.membership.id as string,
     };
   }
+
+  async function createMemberInOrg(orgId: string, label: string) {
+    const user = await createUser(label);
+    const role = await prisma.role.findUniqueOrThrow({
+      where: {
+        orgId_name: {
+          orgId,
+          name: 'Viewer',
+        },
+      },
+      select: {
+        id: true,
+      },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: {
+        id: true,
+        roleId: true,
+      },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
 });