Scope the passwordless invite lookup to its organization (#4025)

`OrganizationRole.create_passwordless` reuses an outstanding invite
instead of creating a second role for the same person —
`CallbackJobs::AfterUserCreateJob` can reach it for a user who was
already invited. But it found that invite with `find_by_invited_email`,
no organization in the lookup, so an invite at *any* organization
matched: the org being joined silently got no role, and the caller was
handed a role belonging to somewhere else.
`Saml::AssertionProcessor#provision_user` reads `.user` off the return
value, so an SSO login for a previously-invited email provisions against
the wrong org.

- **The lookup takes `organization_id`.** All three callers already pass
it.
- **It normalizes the email the way `set_calculated_attributes` stores
it**, so an invite recorded as `Person@Example.com` still matches and
isn't duplicated.

Author: eld120

app/models/organization_role.rb

@@ -58,8 +58,10 @@ def self.role_types
   def self.create_passwordless(**create_attrs)
     new_passwordless_attrs = {skip_processing: true, role: "member"}
     if create_attrs[:invited_email].present? # This should always be present...
-      # We need to check for existing organization_roles because the CallbackJobs::AfterUserCreateJob calls this
-      existing_organization_role = OrganizationRole.find_by_invited_email(create_attrs[:invited_email])
+      # We need to check for existing organization_roles because the CallbackJobs::AfterUserCreateJob calls this.
+      # Scoped to the organization - an invite to a different one says nothing about this one.
+      existing_organization_role = find_by(organization_id: create_attrs[:organization_id],
+        invited_email: EmailNormalizer.normalize(create_attrs[:invited_email]))
       return existing_organization_role if existing_organization_role.present?
     end
     organization_role = create!(new_passwordless_attrs.merge(create_attrs))

spec/models/organization_role_spec.rb

@@ -44,6 +44,40 @@
     end
   end
 
+  describe ".create_passwordless" do
+    let(:invited_email) { "student@sso.edu" }
+    let(:organization) do
+      FactoryBot.create(:organization_with_organization_features, enabled_feature_slugs: "passwordless_users")
+    end
+    let(:create_passwordless) { OrganizationRole.create_passwordless(organization_id: organization.id, invited_email:) }
+
+    it "creates the role and its passwordless user" do
+      expect(create_passwordless.organization_id).to eq organization.id
+      expect(create_passwordless.user.email).to eq invited_email
+      expect(create_passwordless.user.passwordless_user?).to be_truthy
+    end
+
+    it "returns the existing role rather than a second one" do
+      existing = create_passwordless
+      expect {
+        expect(OrganizationRole.create_passwordless(organization_id: organization.id, invited_email: "Student@SSO.edu "))
+          .to eq existing
+      }.to_not change(OrganizationRole, :count)
+    end
+
+    context "invited to a different organization" do
+      let!(:other_organization_role) do
+        FactoryBot.create(:organization_role, invited_email:,
+          organization: FactoryBot.create(:organization))
+      end
+
+      it "creates the role for this organization anyway" do
+        expect(create_passwordless.organization_id).to eq organization.id
+        expect(create_passwordless.id).to_not eq other_organization_role.id
+      end
+    end
+  end
+
   describe "admin?" do
     context "admin" do
       it "returns true" do