fix: if and only if org member should be able to deploy fix at edge

[ravverma]

Summary

Restricts edge deployment and config updates to organization members only. Previously, any user passing hasAccess() (including admins with cross-org access) could deploy/rollback fixes or update edge config. Now, isOwnerOfSite() enforces strict org membership — admins are not exempted.

• New method: AccessControlUtil.isOwnerOfSite(entity) — returns true only if the user belongs to the entity's organization. No admin bypass.
• Applied to: deploySuggestionToEdge and rollbackSuggestionFromEdge in suggestions.js, and createOrUpdateEdgeConfig in llmo.js — returns 403 if the check fails.

Files Changed

File	Change
src/support/access-control-util.js	New isOwnerOfSite() method
src/controllers/suggestions.js	Guard added to deploy and rollback flows
src/controllers/llmo/llmo.js	Guard added to createOrUpdateEdgeConfig
test/support/access-control-util.test.js	7 tests for all isOwnerOfSite branches
test/controllers/suggestions.test.js	Stubs in 3 beforeEach blocks + 2 forbidden-path tests
test/controllers/llmo/llmo.test.js	isOwnerOfSite added to mocks + forbidden-path test for createOrUpdateEdgeConfig

Test Plan

• isOwnerOfSite — missing entity, Site with/without org access, missing org, Organization with/without org access, unknown entity
• Deploy returns 403 when isOwnerOfSite is false
• Rollback returns 403 when isOwnerOfSite is false
• createOrUpdateEdgeConfig returns 403 when isOwnerOfSite is false
• All existing deploy/rollback/edge-config tests pass with stub
• Full test suite green

[github-actions]

This PR will trigger a patch release when merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[solaris007]

🎉 This PR is included in version 1.322.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀