Add suspended state for spaces and deleting state for spaces and orgs (#5206)

Author: johha

app/access/private_domain_access.rb

@@ -66,7 +66,7 @@ def read_for_update?(private_domain, _params=nil)
 
     def update?(private_domain, _params=nil)
       return true if admin_user?
-      return false if private_domain.in_suspended_org?
+      return false if private_domain.in_suspended_or_deleting_org?
 
       private_domain.owning_organization.managers.include?(context.user)
     end

app/access/process_model_access.rb

@@ -54,7 +54,7 @@ def index_with_token?(_)
 
     def create?(app, _params=nil)
       return true if admin_user?
-      return false if app.in_suspended_org?
+      return false if app.in_suspended_or_deleting_org? || app.in_suspended_or_deleting_space?
 
       app.space&.has_developer?(context.user)
     end

app/access/route_access.rb

@@ -76,7 +76,7 @@ def index_with_token?(_)
 
     def can_write_to_route(route, is_create=false)
       return true if context.queryer.can_write_globally?
-      return false if route.in_suspended_org?
+      return false if route.in_suspended_or_deleting_org? || route.in_suspended_or_deleting_space?
       return false if route.wildcard_host? && route.domain.shared?
 
       FeatureFlag.raise_unless_enabled!(:route_creation) if is_create

app/access/route_mapping_access.rb

@@ -54,9 +54,11 @@ def index_with_token?(_)
 
     def create?(route_mapping, _params=nil)
       return true if admin_user?
-      return false if route_mapping.route.in_suspended_org?
 
-      route_mapping.route.space.has_developer?(context.user)
+      space = route_mapping.route.space
+      return false if space.in_suspended_or_deleting_org? || space.in_suspended_or_deleting_space?
+
+      space.has_developer?(context.user)
     end
 
     def read_for_update?(route_mapping, _params=nil)

app/access/service_instance_access.rb

@@ -56,14 +56,14 @@ def create?(service_instance, _params=nil)
       return true if admin_user?
 
       FeatureFlag.raise_unless_enabled!(:service_instance_creation)
-      return false if service_instance.in_suspended_org?
+      return false if service_instance.in_suspended_or_deleting_org? || service_instance.in_suspended_or_deleting_space?
 
       service_instance.space&.has_developer?(context.user) && allowed?(service_instance)
     end
 
     def read_for_update?(service_instance, _params=nil)
       return true if admin_user?
-      return false if service_instance.in_suspended_org?
+      return false if service_instance.in_suspended_or_deleting_org? || service_instance.in_suspended_or_deleting_space?
 
       service_instance.space&.has_developer?(context.user)
     end
@@ -74,7 +74,7 @@ def update?(service_instance, params=nil)
 
     def delete?(service_instance)
       return true if admin_user?
-      return false if service_instance.in_suspended_org?
+      return false if service_instance.in_suspended_or_deleting_org? || service_instance.in_suspended_or_deleting_space?
 
       service_instance.space&.has_developer?(context.user)
     end

app/access/service_key_access.rb

@@ -52,9 +52,11 @@ def index_with_token?(_)
 
     def create?(service_key, _params=nil)
       return true if admin_user?
-      return false if service_key.in_suspended_org?
 
-      service_key.service_instance.space.has_developer?(context.user)
+      space = service_key.service_instance.space
+      return false if space.in_suspended_or_deleting_org? || space.in_suspended_or_deleting_space?
+
+      space.has_developer?(context.user)
     end
 
     def delete?(service_key)

app/access/space_access.rb

@@ -44,7 +44,7 @@ def read_related_object_for_update?(space, params=nil)
 
     def create?(space, _params=nil)
       return true if context.queryer.can_write_globally?
-      return false if space.in_suspended_org?
+      return false if space.in_suspended_or_deleting_org? || space.in_suspended_or_deleting_space?
 
       context.queryer.can_write_to_active_org?(space.organization_id)
     end
@@ -57,7 +57,7 @@ def can_remove_related_object?(space, params)
 
     def read_for_update?(space, _params=nil)
       return true if context.queryer.can_write_globally?
-      return false if space.in_suspended_org?
+      return false if space.in_suspended_or_deleting_org? || space.in_suspended_or_deleting_space?
 
       context.queryer.can_write_to_active_org?(space.organization_id) || context.queryer.can_update_active_space?(space.id, space.organization_id)
     end

app/access/space_quota_definition_access.rb

@@ -48,7 +48,7 @@ def index_with_token?(_)
 
     def create?(space_quota_definition, _params=nil)
       return true if admin_user?
-      return false if space_quota_definition.organization.suspended?
+      return false if space_quota_definition.organization.suspended_or_deleting?
 
       space_quota_definition.organization.managers.include?(context.user)
     end

app/actions/organization_update.rb

@@ -15,6 +15,7 @@ def update(org, message)
         AnnotationsUpdate.update(org, message.annotations, OrganizationAnnotationModel)
 
         if message.requested?(:suspended)
+          error!("Organization '#{org.name}' is being deleted and cannot be updated.") if org.deleting?
           org.status = message.suspended ? Organization::SUSPENDED : Organization::ACTIVE
         end
 

app/actions/space_create.rb

@@ -10,7 +10,11 @@ def initialize(user_audit_info:)
     def create(org, message)
       space = nil
       Space.db.transaction do
-        space = VCAP::CloudController::Space.create(name: message.name, organization: org)
+        space = VCAP::CloudController::Space.create(
+          name: message.name,
+          organization: org,
+          status: message.suspended ? Space::SUSPENDED : Space::ACTIVE
+        )
         MetadataUpdate.update(space, message)
         Repositories::SpaceEventRepository.new.record_space_create(space, user_audit_info, message.audit_hash)
       end