feat(organizations): support many independent organizations per process

crates/fakecloud-cloudformation/src/extras.rs

@@ -2941,7 +2941,9 @@ pub(crate) mod tests {
             ecr: shared::<EcrState>(),
             cloudwatch: Arc::new(RwLock::new(fakecloud_cloudwatch::CloudWatchAccounts::new())),
             elbv2: Arc::new(RwLock::new(fakecloud_elbv2::Elbv2Accounts::new())),
-            organizations: Arc::new(RwLock::new(None)),
+            organizations: Arc::new(RwLock::new(
+                fakecloud_organizations::OrganizationsRegistry::default(),
+            )),
             cognito: shared::<fakecloud_cognito::CognitoState>(),
             rds: shared::<fakecloud_rds::RdsState>(),
             ec2: shared::<fakecloud_ec2::Ec2State>(),

crates/fakecloud-cloudformation/src/resource_provisioner/mod.rs

@@ -4117,7 +4117,7 @@ mod tests {
             )),
             cloudwatch_state: Arc::new(RwLock::new(fakecloud_cloudwatch::CloudWatchAccounts::new())),
             elbv2_state: Arc::new(RwLock::new(fakecloud_elbv2::Elbv2Accounts::new())),
-            organizations_state: Arc::new(RwLock::new(None)),
+            organizations_state: Arc::new(RwLock::new(fakecloud_organizations::OrganizationsRegistry::default())),
             cognito_state: Arc::new(RwLock::new(
                 fakecloud_core::multi_account::MultiAccountState::new("123456789012", "us-east-1", ""),
             )),
@@ -4676,7 +4676,7 @@ mod tests {
         .expect("org provisions");
         let root_id = {
             let g = prov.organizations_state.read();
-            g.as_ref().unwrap().root_id.clone()
+            g.sole().unwrap().root_id.clone()
         };
 
         let ou = prov
@@ -4756,7 +4756,7 @@ mod tests {
         );
 
         let g = prov.organizations_state.read();
-        let org = g.as_ref().unwrap();
+        let org = g.sole().unwrap();
         assert_eq!(org.ous.get(&ou_id).unwrap().name, "team-renamed");
         assert_eq!(org.policies.get(&pol_id).unwrap().content, "{\"v\":2}");
         assert!(

crates/fakecloud-cloudformation/src/resource_provisioner/organizations.rs

@@ -17,16 +17,31 @@ impl ResourceProvisioner {
             .to_string();
 
         let mut org = self.organizations_state.write();
-        if org.is_some() {
-            return Err("Organization already exists; only one per fakecloud process".to_string());
+        // Only the stack's own account blocks this. Organizations are
+        // independent, so another account having one must not stop this
+        // stack from creating its own (#2543).
+        if org.account_is_enrolled(&self.account_id) {
+            return Err(format!(
+                "Account {} is already a member of an organization",
+                self.account_id
+            ));
+        }
+        // The management account registers its own synthetic address, so
+        // that address must be free -- the same rule the API's
+        // `CreateOrganization` applies.
+        let management_email = format!("{}@example.com", self.account_id);
+        if org.email_in_use(&management_email) {
+            return Err(format!(
+                "The email address {management_email} is already associated with another account"
+            ));
         }
         let mut state = OrganizationState::bootstrap(&self.account_id);
         state.feature_set = feature_set;
         let org_id = state.org_id.clone();
         let org_arn = state.org_arn.clone();
         let mgmt_arn = state.management_account_arn.clone();
         let root_id = state.root_id.clone();
-        *org = Some(state);
+        org.insert(state);
 
         Ok(ProvisionResult::new(org_id.clone())
             .with("Id", org_id)
@@ -35,9 +50,11 @@ impl ResourceProvisioner {
             .with("RootId", root_id))
     }
 
-    pub(crate) fn delete_organization(&self, _physical_id: &str) -> Result<(), String> {
+    pub(crate) fn delete_organization(&self, physical_id: &str) -> Result<(), String> {
+        // The physical id IS the organization id, so delete exactly the
+        // one this stack created rather than every organization.
         let mut org = self.organizations_state.write();
-        *org = None;
+        org.remove(physical_id);
         Ok(())
     }
 
@@ -60,7 +77,7 @@ impl ResourceProvisioner {
 
         let mut org_lock = self.organizations_state.write();
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         // Accept root id, OU id, or `Ref`-resolved logical id (we map to root).
         let resolved_parent_id = if parent_id == org.root_id || org.ous.contains_key(&parent_id) {
@@ -96,7 +113,7 @@ impl ResourceProvisioner {
 
     pub(crate) fn delete_organization_unit(&self, physical_id: &str) -> Result<(), String> {
         let mut org_lock = self.organizations_state.write();
-        if let Some(org) = org_lock.as_mut() {
+        if let Some(org) = org_lock.org_of_account_mut(&self.account_id) {
             org.ous.remove(physical_id);
             org.attachments.remove(physical_id);
         }
@@ -148,14 +165,43 @@ impl ResourceProvisioner {
             .unwrap_or_default();
 
         let mut org_lock = self.organizations_state.write();
+        // Authorize FIRST, as the API paths do: the address checks below
+        // span the registry, so running them before resolving the stack
+        // account's own organization would report whether an address is
+        // registered in an organization this stack has nothing to do with.
+        if org_lock.org_of_account(&self.account_id).is_none() {
+            return Err("Organization not yet created".to_string());
+        }
+        // Same address-uniqueness rule the API enforces: resolution by
+        // address decides who may accept an EMAIL-targeted handshake, so
+        // two accounts sharing one would make that answer depend on id
+        // ordering.
+        if org_lock.email_in_use(&email) {
+            return Err(format!(
+                "The email address {email} is already associated with an account"
+            ));
+        }
+        // Mint from the registry so the id cannot collide with an account
+        // another organization already owns.
+        let new_account_id = org_lock.next_account_id();
+        // ...and a `<account-id>@example.com` address belongs to the id it
+        // spells, so this account cannot squat another one's.
+        if fakecloud_organizations::OrganizationsRegistry::email_reserved_for_other(
+            &email,
+            &new_account_id,
+        ) {
+            return Err(format!(
+                "The email address {email} is reserved for another account"
+            ));
+        }
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         // CFN provisioning is its own asynchronous flow; we don't need
         // a second layer of poll-for-completion on top. Begin the
         // request and immediately drive it to SUCCEEDED so the rest of
         // this provisioner sees a fully enrolled account.
-        let pending = org.begin_create_account(&email, &name, None);
+        let pending = org.begin_create_account(&email, &name, new_account_id, None);
         let status = org.complete_create_account(&pending.id).unwrap_or(pending);
         let account_id = status
             .account_id
@@ -216,7 +262,7 @@ impl ResourceProvisioner {
     /// `close_account` so subsequent reads see it as suspended.
     pub(crate) fn delete_organization_account(&self, physical_id: &str) -> Result<(), String> {
         let mut org_lock = self.organizations_state.write();
-        if let Some(org) = org_lock.as_mut() {
+        if let Some(org) = org_lock.org_of_account_mut(&self.account_id) {
             let _ = org.close_account(physical_id);
         }
         Ok(())
@@ -265,7 +311,7 @@ impl ResourceProvisioner {
 
         let mut org_lock = self.organizations_state.write();
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         let id_suffix: String = Uuid::new_v4()
             .simple()
@@ -307,7 +353,7 @@ impl ResourceProvisioner {
 
     pub(crate) fn delete_organization_policy(&self, physical_id: &str) -> Result<(), String> {
         let mut org_lock = self.organizations_state.write();
-        if let Some(org) = org_lock.as_mut() {
+        if let Some(org) = org_lock.org_of_account_mut(&self.account_id) {
             org.policies.remove(physical_id);
             for attachments in org.attachments.values_mut() {
                 attachments.remove(physical_id);
@@ -334,7 +380,7 @@ impl ResourceProvisioner {
 
         let mut org_lock = self.organizations_state.write();
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         org.resource_policy = Some(content);
         let arn = format!(
@@ -349,7 +395,7 @@ impl ResourceProvisioner {
         _physical_id: &str,
     ) -> Result<(), String> {
         let mut org_lock = self.organizations_state.write();
-        if let Some(org) = org_lock.as_mut() {
+        if let Some(org) = org_lock.org_of_account_mut(&self.account_id) {
             org.resource_policy = None;
         }
         Ok(())
@@ -378,7 +424,7 @@ impl ResourceProvisioner {
 
         let mut org_lock = self.organizations_state.write();
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         let ou = org
             .ous
@@ -430,7 +476,7 @@ impl ResourceProvisioner {
 
         let mut org_lock = self.organizations_state.write();
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         // AccountName/Email are immutable; do NOT mint a new account. Move to a
         // new parent if ParentIds changed and refresh tags in place.
@@ -504,7 +550,7 @@ impl ResourceProvisioner {
 
         let mut org_lock = self.organizations_state.write();
         let org = org_lock
-            .as_mut()
+            .org_of_account_mut(&self.account_id)
             .ok_or_else(|| "Organization not yet created".to_string())?;
         let (arn, name) = {
             let policy = org

crates/fakecloud-cloudformation/src/service.rs

@@ -4233,7 +4233,9 @@ mod tests {
             )),
             cloudwatch: Arc::new(RwLock::new(fakecloud_cloudwatch::CloudWatchAccounts::new())),
             elbv2: Arc::new(RwLock::new(fakecloud_elbv2::Elbv2Accounts::new())),
-            organizations: Arc::new(RwLock::new(None)),
+            organizations: Arc::new(RwLock::new(
+                fakecloud_organizations::OrganizationsRegistry::default(),
+            )),
             cognito: Arc::new(RwLock::new(
                 fakecloud_core::multi_account::MultiAccountState::new(
                     "123456789012",