fix: enforce organization affiliation policy during role moves (CM-1132)

[skwowet]

Summary

• Apply organization affiliation policy while moving member organization roles during merge/unmerge flows.
• Replace single/set policy checks with fetchManyOrganizationAffiliationPolicies.
• Prevent policy-generated allowAffiliation = false overrides from leaking when moving roles into an unblocked org, while preserving manual blocks and primary work experience.

---

Note

Medium Risk
Changes merge/unmerge role-movement logic and when affiliation overrides are created/retained, which can impact downstream affiliation recalculation and activity/org attribution. Risk is moderated by being mostly policy-check refactors plus more explicit override resolution, but it touches core merge flows and background workflows.

Overview
Ensures organization-level affiliation blocking is consistently enforced whenever member-organization roles are created or moved, including member/org merge and member unmerge flows, while avoiding stale policy-driven allowAffiliation=false overrides leaking into unblocked orgs.

Replaces per-org/set-based policy checks with a batched fetchManyOrganizationAffiliationPolicies API (returning a Map<orgId, boolean>) and updates callers across API handlers, jobs/scripts, enrichment, and workers.

Refactors role move/merge logic to compute overrides based on target org policy, preserve manual row-level blocks and isPrimaryWorkExperience, and to return/propagate a shouldRecalculateAffiliations flag so finishOrganizationMerging only triggers affiliation recalculation when needed.

^{Reviewed by Cursor Bugbot for commit f3f0b8c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR updates merge/unmerge flows and various ingestion paths to consistently enforce organization affiliation policy (organizations.isAffiliationBlocked) by fetching policies in bulk and applying affiliation override updates when member-organization roles are created or moved.

Changes:

• Replace single-org / set-based policy checks with fetchManyOrganizationAffiliationPolicies() returning a Map<orgId, isBlocked>.
• Enforce affiliation policy when moving roles during org/member merge flows, and propagate a shouldRecalculateAffiliations signal to the org-merge Temporal workflow.
• Apply policy-based allowAffiliation=false overrides in several role-creation paths (enrichment, stint inference, API create, scripts) using batched policy fetches.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
services/libs/data-access-layer/src/members/organizations.ts	Introduces bulk policy fetch Map and applies policy-aware override handling during role moves/merges (also returns recalc hint).
services/libs/common_services/src/services/member/unmerge.ts	Restores org-level policy blocks when re-adding roles on member unmerge.
services/libs/common_services/src/services/common.member.service.ts	Switches role creation policy check to the new bulk-fetch helper.
services/apps/members_enrichment_worker/src/activities/enrichment.ts	Batches policy fetch and batches override writes for enrichment-updated roles.
services/apps/entity_merging_worker/src/workflows/all.ts	Renames/repurposes org-merge workflow flag to shouldRecalculateAffiliations.
services/apps/data_sink_worker/src/service/organization.service.ts	Uses new bulk policy fetch to decide which new roles get overrides.
services/apps/cron_service/src/jobs/inferMemberOrganizationStintChanges.job.ts	Uses new bulk policy fetch for EMAIL_DOMAIN-created roles.
backend/src/services/organizationService.ts	Consumes shouldRecalculateAffiliations from role moves and passes it to the Temporal workflow; removes direct org-wide policy application in merge flow.
backend/src/services/member/memberOrganizationsService.ts	Switches role creation policy check to the new bulk-fetch helper.
backend/src/bin/scripts/backfill-email-domain-member-organization-dates.ts	Switches to new bulk-fetch helper when applying policy overrides during backfill.
backend/src/api/public/v1/members/work-experiences/createMemberWorkExperience.ts	Switches role creation policy check to the new bulk-fetch helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1160206. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.