feat(saas): Phase 3 — plan/seats/active model, ToS consent, signed expiring export

P3a: org carries plan/seats/active/created_at; create_user enforces seats + rejects
inactive org; verify blocks login for inactive orgs; PATCH /api/admin/orgs (super_admin)
updates plan/seats/active with audit. Fixed verify swallowing its AuthError.
P3b: export/token issues a 5-min HMAC one-time CSV link; export accepts ?token=.
P3c: setup requires accepted_terms (consent stored); Setup.vue consent checkbox.
All 8 backend suites pass. Rebuilt dist.

backend/scripts/test_ip_protection.py

@@ -21,7 +21,7 @@ C = app.test_client()
 def tok(u, p): return C.post("/api/auth/login", json={"username": u, "password": p}).get_json()["token"]
 
 AT = tok("admin", "1234"); AH = {"Authorization": f"Bearer {AT}"}
-C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass"})
+C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass", "accepted_terms": True})
 AT = tok("admin", "newpass"); AH = {"Authorization": f"Bearer {AT}"}
 
 gid = C.post("/api/groups", headers=AH, json={"product": "CRM", "segment": "SME", "channel": "line", "language": "th"}).get_json()["group"]["id"]

backend/scripts/test_saas_tenant.py

@@ -22,7 +22,7 @@ def tok(u, p): return C.post("/api/auth/login", json={"username": u, "password":
 
 # super admin setup
 AT = tok("admin", "1234"); AH = {"Authorization": f"Bearer {AT}"}
-C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass"})
+C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass", "accepted_terms": True})
 AT = tok("admin", "newpass"); AH = {"Authorization": f"Bearer {AT}"}
 
 # create org1 data (a group)
@@ -80,4 +80,44 @@ assert code == 429, ("expected 429 after login hammering", code)
 rate_limit._mem.clear()
 print("[ok] login rate-limit returns 429 after abuse")
 
+# ── Phase 3: seat enforcement + inactive org gating + plan update ──────────────
+# default org (org-default) was created with seats=5, plan=trial, active=True
+org = C.get("/api/admin/orgs", headers=AH).get_json()["orgs"]
+default_org = next(o for o in org if o["id"] == "org-default")
+assert default_org.get("plan") == "trial" and default_org.get("seats") == 5 and default_org.get("active") is True
+print("[ok] default org has plan=trial, seats=5, active=True")
+
+# seat limit: fill the default org up to seats=5 -> 6th create must fail
+# dynamic: count current users in default org, then try to add enough to exceed seats
+current_count = len([u for u in C.get("/api/admin/users", headers=AH).get_json()["users"] if u.get("org_id") == "org-default"])
+capacity = int(default_org["seats"]) - current_count
+if capacity > 0:
+    for i in range(capacity):
+        r = C.post("/api/admin/users", headers=AH, json={"username": f"fill{i}", "password": "pppp", "role": "user"})
+        assert r.status_code == 201, r.get_json()
+# now one more must exceed seats
+r = C.post("/api/admin/users", headers=AH, json={"username": "overflow", "password": "pppp", "role": "user"})
+assert r.status_code == 400, ("seat limit should block", r.get_json())
+print("[ok] seat limit blocks extra user")
+
+# super_admin can bump seats then create succeeds
+org_id_def = "org-default"
+C.patch(f"/api/admin/orgs/{org_id_def}", headers=AH, json={"seats": 99})
+r = C.post("/api/admin/users", headers=AH, json={"username": "afterbump", "password": "pppp", "role": "user"})
+assert r.status_code == 201, r.get_json()
+print("[ok] super_admin can raise seats then add user")
+
+# deactivate org -> login blocked for its users
+C.patch(f"/api/admin/orgs/{org_id_def}", headers=AH, json={"active": False})
+code = C.post("/api/auth/login", json={"username": "admin", "password": "newpass"}).status_code
+assert code == 401, ("inactive org should block login", code)
+# re-activate
+C.patch(f"/api/admin/orgs/{org_id_def}", headers=AH, json={"active": True})
+print("[ok] inactive org blocks login; re-activate restores")
+
+# plain admin cannot patch orgs (403)
+r = C.patch(f"/api/admin/orgs/{org_id_def}", headers=AH2, json={"seats": 200})
+assert r.status_code == 403, r.status_code
+print("[ok] plain admin cannot update org plan")
+
 print("ALL SAAS MULTI-TENANT TESTS PASSED")

backend/scripts/test_scenario.py

@@ -30,7 +30,7 @@ def login(u, p):
 
 AT = login("admin", "1234")
 AH = {"Authorization": f"Bearer {AT}"}
-C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass"}).get_json()
+C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass", "accepted_terms": True}).get_json()
 # re-login with new password
 AT = login("admin", "newpass")
 AH = {"Authorization": f"Bearer {AT}"}

backend/scripts/test_setup.py

@@ -39,8 +39,8 @@ def main():
     assert r.status_code == 400, r.get_json()
     print("[ok] setup rejects bad email/short password")
 
-    # 3. Successful setup: email + new password, clears must_setup
-    r = client.post("/api/auth/setup", json={"username": "admin", "email": "admin@corp.com", "password": "NewPass!42"}, headers=H)
+    # 3. Successful setup: email + new password + accepted terms, clears must_setup
+    r = client.post("/api/auth/setup", json={"username": "admin", "email": "admin@corp.com", "password": "NewPass!42", "accepted_terms": True}, headers=H)
     assert r.status_code == 200, r.get_json()
     assert r.get_json()["must_setup"] is False
     print("[ok] setup completes -> must_setup=false")