security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Models/Event.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Scopes\OrganisationScope;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Concerns\HasUlids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -20,6 +21,14 @@ final class Event extends Model
     use HasUlids;
     use SoftDeletes;
 
+    /** @var string Used by OrganisationScope to determine filtering strategy */
+    public string $organisationScopeColumn = 'organisation_id';
+
+    protected static function booted(): void
+    {
+        static::addGlobalScope(new OrganisationScope());
+    }
+
     /** @var array<string, list<string>> Allowed status transitions */
     public const STATUS_TRANSITIONS = [
         'draft' => ['published'],