Matt d80efc88b4 feat(ban): runtime enforcement for ban-scope bitmask ...

The bitmask landed in 000045 with schema + UI; this commit wires the
three gates the bits describe.

  - BanScopeLogin    → authService.LoginConfirm checks the scope after
                       password verification and refuses the session
                       with "this account has been suspended"
  - BanScopeOrgCreate → organizationService.Create checks the scope
                       before any other validation and refuses with
                       "this account cannot create new workspaces"
  - BanScopeSend     → emailSendService.SendEmail checks the scope
                       before validating the email account and refuses
                       with "this account cannot send email"

Adds UserRepository.GetBanState(ctx, userID) → uint32 — a single-column
read so the hot paths don't have to fetch the full user row just to
check a flag. Returns 0 when no ban (the column defaults to 0); the
caller treats 0 as "allow."

Threads userRepo into emailSendService — the only constructor change
in this commit. cmd/backend/main.go updated accordingly.

2026-05-28 12:43:50 +02:00

..

backend

feat(ban): runtime enforcement for ban-scope bitmask

2026-05-28 12:43:50 +02:00

consumer

ci(go): gofmt all flagged files

2026-05-27 16:40:23 +00:00

seed

style: gofmt struct alignment after burst_multiplier removal

2026-05-27 16:17:53 +00:00

worker

fleet: wire health collection so the autonomous loops actually have data

2026-05-27 16:03:35 +00:00