fix: community access to public-project organizations

[Anty0]

Re-lands the organization-permissions lane of Community Translation v1, which is missing from main.

The problem

Opening a public project partially fails. The frontend sets the preferred organization to the project's owner org on every project open (ProjectContext.tsx → PUT /v2/user-preferences/set-preferred-organization/{id}), and that call is rejected for community users.

main still has the strict check in UserPreferencesController:

organizationRoleService.checkUserCanView(organization.id)

which resolves to OrganizationRepository.canUserView, whose predicate is (perm is not null or mr is not null) — it requires a stored Permission or OrganizationRole row. The community floor from #3770 is computed by design, so contributors don't consume a paid seat. No row → PermissionException(USER_CANNOT_VIEW_THIS_ORGANIZATION) → 403.

How it went missing

#3792 was merged into jirikuchynka/public-projects on 2026-07-13 (merge commit 93e6fd9cc). That branch was subsequently rebased and force-pushed; the rebase dropped the merge commit along with its two payload commits. #3765 then squash-merged the rebased branch into main as 4a4ea3f55, shipping v1 without this lane. GitHub still reports #3792 as MERGED, which is why it went unnoticed.

This PR

git cherry-pick -m 1 93e6fd9cc onto main — applied with no conflicts, and the resulting diff against main is identical to the original payload (55 files, 2197+/129-).

Contents (unchanged from #3792):

• OrganizationRoleService.canUserViewStrictOrPublic / checkUserCanViewOrPublic — the org view floor: strict check OR projectService.hasPublicProjects(organizationId)
• Applied at UserPreferencesController:61 and OrganizationAuthorizationInterceptor:75
• PreferredOrganizationFacade heals stale/missing preferences in place and emits PrivateOrganizationModel.limitedView for below-member viewers
• Scoping of org language reads to accessible projects for below-member viewers
• Glossary guest access, member-listing and usage exclusions for floor viewers

Verification

• :data:/:api:/:security:/:development:compileKotlin — BUILD SUCCESSFUL
• UserPreferencesSetPreferredOrganizationTest — 7/7 passed
• OrganizationFloorAccessTest — 29/29 passed
• webapp + e2e eslint --fix and tsc — clean, no files changed

Summary by CodeRabbit

• New Features
  • Community and below-member viewers now receive organization models tailored to public-project access, including a new limitedView flag and safer subscription-related visibility behavior.
• Bug Fixes
  • Preferred-organization and “managed-by” responses now respect updated viewability rules and permission filtering, with stronger stale-preference healing when the stored organization becomes unavailable.
  • Organization language/project listing queries are now restricted to only the projects accessible to the current caller.
  • Authorization “view floor” enforcement was tightened to allow the correct default endpoints while keeping role-required routes protected.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: be1c0500-7daf-402d-a797-d496336f9c90

📥 Commits

Reviewing files that changed from the base of the PR and between 1344351 and bfe364f.

⛔ Files ignored due to path filters (1)

• webapp/src/service/apiSchema.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (16)

• backend/api/src/main/kotlin/io/tolgee/component/PreferredOrganizationFacade.kt
• backend/api/src/main/kotlin/io/tolgee/hateoas/organization/PrivateOrganizationModel.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationFloorAccessTest.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/builders/TestDataBuilder.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/data/PublicProjectsE2eData.kt
• backend/data/src/main/kotlin/io/tolgee/repository/OrganizationRepository.kt
• backend/data/src/main/kotlin/io/tolgee/repository/ProjectRepository.kt
• backend/data/src/main/kotlin/io/tolgee/service/organization/OrganizationRoleService.kt
• backend/data/src/main/kotlin/io/tolgee/service/security/SecurityService.kt
• backend/security/src/main/kotlin/io/tolgee/security/authorization/OrganizationAuthorizationInterceptor.kt
• backend/security/src/test/kotlin/io/tolgee/security/authorization/OrganizationAuthorizationInterceptorTest.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/repository/glossary/GlossaryRepository.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/service/glossary/GlossaryService.kt
• ee/backend/tests/src/test/kotlin/io/tolgee/ee/api/v2/controllers/glossary/GlossaryGuestAccessTest.kt
• webapp/src/views/organizations/OrganizationProfileView.tsx
• webapp/src/views/projects/ProjectListView.tsx

💤 Files with no reviewable changes (5)

• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/data/PublicProjectsE2eData.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/service/glossary/GlossaryService.kt
• backend/data/src/main/kotlin/io/tolgee/service/organization/OrganizationRoleService.kt
• backend/security/src/test/kotlin/io/tolgee/security/authorization/OrganizationAuthorizationInterceptorTest.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/repository/glossary/GlossaryRepository.kt

🚧 Files skipped from review as they are similar to previous changes (11)

• backend/api/src/main/kotlin/io/tolgee/hateoas/organization/PrivateOrganizationModel.kt
• webapp/src/views/projects/ProjectListView.tsx
• backend/api/src/main/kotlin/io/tolgee/component/PreferredOrganizationFacade.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/builders/TestDataBuilder.kt
• webapp/src/views/organizations/OrganizationProfileView.tsx
• backend/security/src/main/kotlin/io/tolgee/security/authorization/OrganizationAuthorizationInterceptor.kt
• backend/data/src/main/kotlin/io/tolgee/service/security/SecurityService.kt
• backend/data/src/main/kotlin/io/tolgee/repository/ProjectRepository.kt
• backend/data/src/main/kotlin/io/tolgee/repository/OrganizationRepository.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationFloorAccessTest.kt
• ee/backend/tests/src/test/kotlin/io/tolgee/ee/api/v2/controllers/glossary/GlossaryGuestAccessTest.kt

---

📝 Walkthrough

Walkthrough

Community access now recognizes public-project organizations and below-member permissions across organization, project, language, glossary, and preferred-organization flows. Models expose limited-view state, clients adapt their UI accordingly, and backend, EE, unit, and Cypress tests cover access boundaries and stale preference recovery.

Changes

Community access and visibility

Layer / File(s)	Summary
Visibility rules and authorization backend/data/..., backend/api/..., backend/security/...	Public-project visibility, below-member project queries, organization role checks, authorization interception, preference refresh, and language filtering now use explicit public-aware access methods.
Preferred organization models backend/api/..., backend/app/src/test/...	Preferred organization models validate stale preferences and expose limitedView; subscriptions are returned only for members, with coverage for community users, members, direct permissions, and recovery cases.
Below-member glossary access ee/backend/..., ee/backend/tests/...	Glossary listings, statistics, assigned projects, terms, and exports are filtered by projects accessible to the current caller.
Access test fixtures and validation backend/data/..., backend/app/src/test/...	Test builders support post-save database fixups and expanded deleted, missing-language, public, private, and permission scenarios.
Client role and preferred-organization behavior webapp/..., e2e/cypress/...	The web client uses member-role checks and limited-view state for project lists, settings, permissions, and organization switching; Cypress coverage validates these flows.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• tolgee/tolgee-platform#3248: Reuses supporter-role semantics in preferred-organization visibility and subscription gating.

Suggested reviewers: dkrizan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 2.21% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enabling community access to organizations with public projects.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jirikuchynka/reland-community-preferred-org

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

webapp/src/component/layout/BaseSettingsView/SettingsMenuItem.tsx (1)

37-62: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Use unique data-cy values instead of introducing data-cy-item. The current contract forces tests to combine a generic data-cy with an unsupported secondary selector attribute.

• webapp/src/component/layout/BaseSettingsView/SettingsMenuItem.tsx#L37-L62: render the supplied unique selector directly through data-cy.
• webapp/src/component/layout/BaseSettingsView/SettingsMenu.tsx#L30-L30: rename and forward the prop as the component’s data-cy value.
• webapp/src/views/organizations/components/BaseOrganizationSettingsView.tsx#L58-L98: provide complete unique selectors such as settings-menu-item-profile, settings-menu-item-glossaries, and settings-menu-item-translation-memories.

As per coding guidelines, “STRICTLY use data-cy attributes for E2E selectors, never rely on text content; use typed helpers gcy() or cy.gcy().”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@webapp/src/component/layout/BaseSettingsView/SettingsMenuItem.tsx` around
lines 37 - 62, Replace the secondary dataCyItem selector in SettingsMenuItem
with the supplied unique value rendered directly as data-cy. In SettingsMenu,
rename and forward its prop as the component’s data-cy value. In
BaseOrganizationSettingsView, provide complete unique selectors for each menu
entry, including the profile, glossaries, and translation memories items, and
keep E2E selectors based exclusively on data-cy.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationFloorAccessTest.kt`:
- Around line 117-128: Replace the manual JSON parsing and generic collection
assertions in the organization floor-access tests, including orgLanguageTags and
the corresponding range, with andAssertThatJson assertions. Assert the language
tags through JSON paths using the existing response assertion DSL, preserving
the current expected values and request behavior while retaining JSON-path
diagnostics.

In `@backend/data/src/main/kotlin/io/tolgee/repository/ProjectRepository.kt`:
- Around line 71-78: Update BELOW_MEMBER_ACCESSIBLE_PROJECT so its permission
existence check excludes Permission rows whose access level is NONE, matching
the existing rejection logic elsewhere. Ensure only non-NONE permissions satisfy
the user/project access condition, while preserving public visibility handling.

In `@e2e/cypress/e2e/projects/communityPreferredOrganization.cy.ts`:
- Line 33: Replace the text-based project selectors around the Community Alpha
interactions with typed data-cy hooks on the target project items, then select
them exclusively through gcy() or cy.gcy(). Add distinct stable hooks for each
affected fixture and preserve the existing click/assertion behavior without
relying on rendered project names.

In `@webapp/src/component/layout/BaseSettingsView/SettingsMenuItem.tsx`:
- Line 37: Replace the SettingsMenuItem dataCyItem selector prop and its
rendered attribute with the required data-cy convention, generating a unique
value such as settings-menu-item-profile for each menu item. Update the related
selector usage to call gcy() or cy.gcy() and ensure all affected menu items
expose unique data-cy values without relying on text content.

In `@webapp/src/views/organizations/components/BaseOrganizationSettingsView.tsx`:
- Line 58: Update the menu entry selectors in the organization settings view,
including the entries around profile and the other referenced locations, to use
complete values such as settings-menu-item-profile through the existing data-cy
contract. Ensure the emitted data-cy-item identifiers are explicit and follow
the typed gcy()/cy.gcy() selector convention without relying on menu text.

---

Outside diff comments:
In `@webapp/src/component/layout/BaseSettingsView/SettingsMenuItem.tsx`:
- Around line 37-62: Replace the secondary dataCyItem selector in
SettingsMenuItem with the supplied unique value rendered directly as data-cy. In
SettingsMenu, rename and forward its prop as the component’s data-cy value. In
BaseOrganizationSettingsView, provide complete unique selectors for each menu
entry, including the profile, glossaries, and translation memories items, and
keep E2E selectors based exclusively on data-cy.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 15919387-85ad-4ae6-b1cd-66fd4424afdd

📥 Commits

Reviewing files that changed from the base of the PR and between 0987795 and 1739b86.

⛔ Files ignored due to path filters (1)

• webapp/src/service/apiSchema.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (54)

• backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/UserPreferencesController.kt
• backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/V2UserController.kt
• backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/organization/OrganizationLanguageController.kt
• backend/api/src/main/kotlin/io/tolgee/component/PreferredOrganizationFacade.kt
• backend/api/src/main/kotlin/io/tolgee/hateoas/organization/PrivateOrganizationModel.kt
• backend/api/src/main/kotlin/io/tolgee/hateoas/organization/PrivateOrganizationModelAssembler.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/PreferredOrganizationCommunityTest.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/PublicProjectsControllerTest.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/UserPreferencesSetPreferredOrganizationTest.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationCommunityAccessTest.kt
• backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationFloorAccessTest.kt
• backend/app/src/test/kotlin/io/tolgee/service/RefreshPreferredOrganizationTest.kt
• backend/app/src/test/kotlin/io/tolgee/unit/PrivateOrganizationModelAssemblerTest.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/TestDataService.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/builders/LanguageBuilder.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/builders/OrganizationBuilder.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/builders/ProjectBuilder.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/builders/TestDataBuilder.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/data/GlossaryGuestAccessTestData.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/data/PublicProjectsControllerTestData.kt
• backend/data/src/main/kotlin/io/tolgee/development/testDataBuilder/data/PublicProjectsE2eData.kt
• backend/data/src/main/kotlin/io/tolgee/model/enums/OrganizationRoleType.kt
• backend/data/src/main/kotlin/io/tolgee/repository/ProjectRepository.kt
• backend/data/src/main/kotlin/io/tolgee/repository/UserAccountRepository.kt
• backend/data/src/main/kotlin/io/tolgee/service/organization/OrganizationRoleService.kt
• backend/data/src/main/kotlin/io/tolgee/service/project/ProjectService.kt
• backend/data/src/main/kotlin/io/tolgee/service/security/UserPreferencesService.kt
• backend/data/src/test/kotlin/io/tolgee/unit/OrganizationRoleTypeTest.kt
• backend/development/src/main/kotlin/io/tolgee/controllers/internal/e2eData/PublicProjectsE2eDataController.kt
• backend/security/src/main/kotlin/io/tolgee/security/authorization/OrganizationAuthorizationInterceptor.kt
• backend/security/src/test/kotlin/io/tolgee/security/authorization/OrganizationAuthorizationInterceptorTest.kt
• e2e/cypress/e2e/projects/communityPreferredOrganization.cy.ts
• e2e/cypress/e2e/projects/communityProjectsNavigation.cy.ts
• e2e/cypress/e2e/projects/publicProjects.cy.ts
• e2e/cypress/support/dataCyType.d.ts
• ee/backend/app/src/main/kotlin/io/tolgee/ee/api/v2/controllers/glossary/GlossaryController.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/repository/glossary/GlossaryRepository.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/repository/glossary/GlossaryTermRepository.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/service/glossary/GlossaryExportService.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/service/glossary/GlossaryService.kt
• ee/backend/app/src/main/kotlin/io/tolgee/ee/service/glossary/GlossaryTermService.kt
• ee/backend/tests/src/test/kotlin/io/tolgee/ee/api/v2/controllers/AuthProviderChangeControllerEeTest.kt
• ee/backend/tests/src/test/kotlin/io/tolgee/ee/api/v2/controllers/glossary/GlossaryGuestAccessTest.kt
• webapp/src/component/layout/BaseSettingsView/SettingsMenu.tsx
• webapp/src/component/layout/BaseSettingsView/SettingsMenuItem.tsx
• webapp/src/fixtures/__tests__/organizationRole.test.ts
• webapp/src/fixtures/organizationRole.ts
• webapp/src/globalContext/useInitialDataService.ts
• webapp/src/globalContext/useOrganizationUsageService.ts
• webapp/src/views/organizations/OrganizationProfileView.tsx
• webapp/src/views/organizations/components/BaseOrganizationSettingsView.tsx
• webapp/src/views/projects/ProjectListView.tsx
• webapp/src/views/projects/members/component/MemberItem.tsx
• webapp/src/views/projects/members/component/RevokePermissionsButton.tsx

[dkrizan]

I would put it in a service (maybe SecurityService?).