Scope the passwordless invite lookup to its organization

create_passwordless reuses an outstanding invite rather than creating a second
role for the same person, but it looked the invite up by email alone. An invite
at any other organization matched and was returned, so the organization actually
being joined never got a role - and the caller got back a role belonging to
somewhere else. Saml::AssertionProcessor reads .user off that role, so an SSO
login could provision against the wrong organization entirely.

The lookup now takes organization_id, and normalizes the email the way the
record stores it so a differently-cased invite still matches.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: eld120

app/models/organization_role.rb

@@ -58,8 +58,10 @@ def self.role_types
   def self.create_passwordless(**create_attrs)
     new_passwordless_attrs = {skip_processing: true, role: "member"}
     if create_attrs[:invited_email].present? # This should always be present...
-      # We need to check for existing organization_roles because the CallbackJobs::AfterUserCreateJob calls this
-      existing_organization_role = OrganizationRole.find_by_invited_email(create_attrs[:invited_email])
+      # We need to check for existing organization_roles because the CallbackJobs::AfterUserCreateJob calls this.
+      # Scoped to the organization - an invite to a different one says nothing about this one.
+      existing_organization_role = find_by(organization_id: create_attrs[:organization_id],
+        invited_email: EmailNormalizer.normalize(create_attrs[:invited_email]))
       return existing_organization_role if existing_organization_role.present?
     end
     organization_role = create!(new_passwordless_attrs.merge(create_attrs))

spec/models/organization_role_spec.rb

@@ -44,6 +44,40 @@
     end
   end
 
+  describe ".create_passwordless" do
+    let(:invited_email) { "student@sso.edu" }
+    let(:organization) do
+      FactoryBot.create(:organization_with_organization_features, enabled_feature_slugs: "passwordless_users")
+    end
+    let(:create_passwordless) { OrganizationRole.create_passwordless(organization_id: organization.id, invited_email:) }
+
+    it "creates the role and its passwordless user" do
+      expect(create_passwordless.organization_id).to eq organization.id
+      expect(create_passwordless.user.email).to eq invited_email
+      expect(create_passwordless.user.passwordless_user?).to be_truthy
+    end
+
+    it "returns the existing role rather than a second one" do
+      existing = create_passwordless
+      expect {
+        expect(OrganizationRole.create_passwordless(organization_id: organization.id, invited_email: "Student@SSO.edu "))
+          .to eq existing
+      }.to_not change(OrganizationRole, :count)
+    end
+
+    context "invited to a different organization" do
+      let!(:other_organization_role) do
+        FactoryBot.create(:organization_role, invited_email:,
+          organization: FactoryBot.create(:organization))
+      end
+
+      it "creates the role for this organization anyway" do
+        expect(create_passwordless.organization_id).to eq organization.id
+        expect(create_passwordless.id).to_not eq other_organization_role.id
+      end
+    end
+  end
+
   describe "admin?" do
     context "admin" do
       it "returns true" do