feat(orgs): delete, leave, suspend, My Organizations, and org LinkedIn (G25)

[Adron]

Summary

Closes the organization lifecycle and shared-LinkedIn gaps from #54 (G25): delete an org, leave one, suspend/restore a member, My Organizations as its own surface with join, and the four org-LinkedIn routes. Last-owner protection and the "nobody leaves The Public" rule are enforced client-side before any network call, so the user gets a specific sentence instead of a bare server rejection.

Three of the four verbs the issue asked for turned out not to be routes at all, and the recon uncovered three already-shipped defects sitting underneath the feature — including one that made the composer tell users something untrue.

Route findings (all verified read-only)

The test account is shared with 7 concurrent sessions, so not a single write was issued. Verbs came from OPTIONS and GET /api/openapi.json; request bodies were confirmed against the shipped web client's own JS bundle and the OpenAPI schemas independently.

• POST /api/user/organizations is the join path, body {"organizationId": …} — confirmed twice, not guessed. There is no /api/organizations/{id}/join (404).
• There is no leave route. Leaving is DELETE /api/organizations/{id}/members/{yourUserId}, which is exactly what the web client does.
• Suspension is not a route. It is active: false on the member-update body, sent alongside the member's existing role so a suspend cannot silently change it.
• /help/api/organizations is stale on two rows. It documents GET on linkedin/sync-pages and linkedin/assignments; both answer 405 live and neither appears in the OpenAPI document. So linkedin/status is the only readable org-LinkedIn route, and the discovered pages and current assignments have to come back through it.
• PUT linkedin/assignments takes one {userId, pageId} pair, per the OpenAPI body schema — not the "assignment map" the help page describes. Where the two sources disagree, OpenAPI has now won twice.
• orgScopesEnabled re-confirmed (the ⚠️ on the issue): all four org-LinkedIn routes are deployed and Bearer-reachable.

Defects found and fixed on the way

1. GET /api/user/organizations is a Bearer route, not session-only. Decision 0001 recorded it as session-only and the kit shipped auth: .session. A raw curl carrying only Authorization: Bearer — no cookie jar — returns HTTP 200, and the OpenAPI document marks it x-auth-type: sync-token. The same spec correctly reports session for /api/user/engagement, which this repo independently confirmed, so the field is trustworthy in both directions.
2. The members listing could never decode. GET /api/organizations/{id}/members keys rows by id, not userId, and dates them joinedAt, not createdAt. OrganizationMemberDTO required userId, so every real response failed with keyNotFound and the roster never rendered — the same silent-decode family as the G21 link-metadata bug. The existing kit test used a fabricated {"userId": …} fixture, which is why it stayed green. Rows also carry the member's identity, so the roster now renders names instead of raw UUIDs and needs no second lookup.
3. LinkedInTargetDTO.kind had the wrong taxonomy. The real tokens are personal / orgPage / personalPage (with pageId / personalPageId / linkedInPageId / logoUrl); the client modelled personal / org, so org-page targets decoded as unknown and lost their page identity. That made the composer's "Posting as …" line actively wrong: per /help/organizations an assigned member's default LinkedIn destination is the company page, so the line named their personal profile while the server published to a company page. Fixed via LinkedInPostingTargets.defaultDestination, and the company-page case now says so in as many words.

Changes

• Kit — Organizations.delete + the four org-LinkedIn builders; User.joinOrganization (one additive builder) and the one-line auth correction on User.organizations; OrgLinkedInDTO.swift; corrected OrganizationMemberDTO (tolerant of both wire spellings) and LinkedInTargetDTO; membership-context fields on OrganizationDTO / UserOrganizationDTO.
• Domain — OrgServicing: delete, leave, suspend, and the four org-LinkedIn verbs; OrgLifecycleError + OrgOwnershipRules as pure, testable predicates; OrgLinkedIn.swift models; UserServicing.joinOrganization; Organization.isSystem / slug / memberCount; OrgMember identity + isSuspended.
• Persistence — isSystem / slug / memberCount and member identity round-trip through SwiftData, so the no-leave rule holds on a cache-first paint before any network read confirms it.
• App — My Organizations rows with role, joined date and member count; per-row Leave; owner-only Delete behind a confirmation that names the org and states it is not reversible; a browse-and-join sheet; suspend/restore in the members table with last-owner gating; an owner/admin org-LinkedIn section (connect, sync, assign, disconnect) whose disconnect confirmation names how many members it affects; the composer destination fix.

Deliberately not built

Two shapes could not be confirmed read-only, and are flagged in the code rather than guessed at: the connected shape of linkedin/status (no org reachable from the test account has a credential — the decoder accepts both the observed {credential, role} and the documented {connected, expiresAt, pages}), and the 201 bodies of join and sync-pages (both ignored via sendVoid plus a re-read of a shape that has been seen, rather than decoding an unseen one). Whether pageId: nil clears an assignment is the one inference made; it is called out in UpdateOrgLinkedInAssignmentRequest.

Verification

Full E2E gate, re-run after merging origin/dev (which brought in #37):

• xcodebuild … build → ** BUILD SUCCEEDED **
• xcodebuild … test → Executed 800 tests, with 0 failures (0 unexpected) → ** TEST SUCCEEDED **
• swift test --package-path Packages/InterlinedKit → Executed 412 tests, with 0 failures (0 unexpected)
• swift test --package-path Packages/InterlinedDomain → Executed 829 tests, with 0 failures (0 unexpected)
• swift test --package-path Packages/InterlinedPersistence → Executed 140 tests, with 0 failures (0 unexpected)
• grep -rn "^import InterlinedKit" App/Features App/Navigation App/MenuCommands → 0 hits (Decision 0003)
• Env-gated live ContractTests → ran, Executed 4 tests, with 0 failures (0 unexpected)

BDD quartets ship with every behavior change: happy (leave a non-system org, delete an owned org, suspend and restore, assign a page), invalid (last owner tries to leave / be demoted / be suspended; anyone tries to leave "The Public"; non-owner delete; member tries to manage org LinkedIn — each asserting no service call was made), upstream-failure (sync-pages fails → assignments UI keeps the stale page list, error surfaced separately; every optimistic mutation rolls back), and boundary (one owner + one member; a member with and without a page assignment; empty rosters; partial rosters that must not block).

Closes #54.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FAaFauZruiXx6zFS3nKhxA