[2c] Org isolation enforcement

[andrmaz]

What to build

All read and write paths in the API and MCP layer are scoped by the authenticated user's Organization at the middleware/query layer. Cross-organization data access is blocked by default. Org-scoping is enforced for every Prisma query and is not an opt-in.

Acceptance criteria

• A middleware/helper enforces org-scoped filtering on all DB queries.
• Attempting to read another org's data via API returns 403/404.
• MCP calls are also org-scoped — no cross-org leakage through the MCP path.
• Integration tests verify isolation for both API and MCP paths.

Blocked by

• [1c] MCP entrypoint + identity resolution #7 [1c] MCP entrypoint + identity resolution
• [2b] User and department management #5 [2b] User and department management

[andrmaz]

@cursoragent build

[cursor]

I've implemented org isolation enforcement for PR #32, building the whole "2c" slice from the issue description.

Core mechanism: I built a Prisma Client Extension in packages/db (org-scope module) that automatically injects org filters on every query — reads, creates, updates, deletes — using an AsyncLocalStorage-backed context. Queries made with no active org context fail closed with MissingOrgContextError; a deliberate runWithoutOrgScope escape hatch covers the one legitimate pre-auth case (resolving a user's org during login). PrismaService no longer extends PrismaClient directly — every model delegate it exposes now routes through the scoped client, and the raw client has zero external accessor, so there's no way for application code to bypass scoping.

Wiring: A global OrgContextInterceptor binds the authenticated caller's organizationId for the whole request; an OrgScopeExceptionFilter maps cross-org write attempts to 403. I also found and fixed a real, concrete cross-org leak: OrganizationsController had zero org scoping — any admin could list every organization in the system, read any org by id, or rename any org. It now follows the same 403-on-mismatch convention already used by the departments/users controllers.

Testing: 61 new unit tests in packages/db (pure scoping logic plus a fake-Prisma-client harness that faithfully reproduces the real $extends contract, no DB needed), new integration tests in apps/api for the interceptor, exception filter, organizations cross-org 403s, and MCP cross-org isolation/concurrency. I also stood up a real local Postgres and ran a genuine end-to-end verification script, which caught two subtle real bugs that mocks alone wouldn't have: (1) Prisma's lazy promises silently drop AsyncLocalStorage context unless the callback is async, and (2) Prisma's WhereUniqueInput requires the unique field to stay flat — AND-wrapping breaks findUnique/update/delete. Both are fixed and now documented/tested.

Full pnpm test / check-types / lint all pass across the monorepo.