Skip membership check for IRE staff

[Copilot]

Users with an @ire.org email returned by the auth service should have unconditional access, bypassing the active membership requirement.

Changes

• app/auth/dependencies.py — require_member now grants access when session.email ends with @ire.org (case-insensitive), regardless of is_active_member

• app/auth/membersuite_client.py — authenticate_and_verify also skips the membership check for @ire.org emails, so IRE staff are never blocked before a session is created even when MS_REQUIRE_MEMBERSHIP=true

is_ire_staff = user.email.lower().endswith("@ire.org")
if require_membership and not is_ire_staff and not user.is_active_member:
    raise MembershipRequiredError()

• tests/test_auth/test_require_member.py — New test file covering: staff bypass with/without membership, case-insensitivity, and denial of non-@ire.org addresses (including subdomains like @staff.ire.org and lookalikes like @notire.org)

• tests/test_auth/test_membersuite_client.py — New test file covering the bypass in authenticate_and_verify: active member allowed, inactive member denied, IRE staff bypass, case-insensitivity, and that similar-but-non-matching domains are still denied

[Copilot]

Pull request overview

Adjusts member-only access control so authenticated users with an @ire.org email can access member-only endpoints without needing an active membership.

Changes:

• Updated require_member to bypass the membership check for emails ending with @ire.org (case-insensitive).
• Added unit tests covering staff bypass, case-insensitivity, and denial for non-matching domains/subdomains.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
app/auth/dependencies.py	Adds @ire.org staff bypass logic and updates the dependency docstring.
tests/test_auth/test_require_member.py	Introduces tests validating the bypass and rejection rules.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[palewire]

@copilot, can you fix this error in our CI?

[2026-04-11][01:59:44][ruff::commands::format][DEBUG] Formatted 50 files in 12.72ms
Would reformat: tests/test_auth/test_membersuite_client.py
1 file would be reformatted, 49 files already formatted
Error: The process '/opt/hostedtoolcache/ruff/0.15.10/x86_64/ruff' failed with exit code 1

[Copilot]

@copilot, can you fix this error in our CI?

...

Fixed in ea6d4c5 — ran ruff format on tests/test_auth/test_membersuite_client.py to resolve the formatting issue.