[A-RYAN-1]

What github issue is this PR for, if any?

Resolves #7106 (step 1, the case lookups only)

What changed, and why?

Case slugs and case numbers are only unique within an org, so an unscoped CasaCase lookup can resolve another org's case when two orgs share a number. This resolves the case through current_organization.casa_cases in the five places the issue lists:

• casa_cases#copy_court_orders: find_by! on the case number, so a number from another org is a 404 instead of copying that org's court orders
• fund_requests: scoped lookup, keeps the existing redirect to root for a case the user cannot reach
• emancipations#show and #save
• case_assignments#case_assignment_parent
• volunteers#activate: the case is resolved before the volunteer is activated, so a case that is not in the org is a 404 with no activation and no email
• CaseCourtReportContext: CasaCase.find by id (both callers pass the id of an already scoped case), so no unscoped friendly.find is left in the app

The org-in-URL routes, slug backfill, FriendlyId history and org slug hardening are left for follow-up PRs, as discussed on the issue.

How is this tested? (please write rspec and jest tests!)

New spec/requests/case_lookup_org_scoping_spec.rb: the same case number exists in two orgs (the other org's case is created first) and the caller resolves to their own org's case, and a case that exists only in another org is not reachable through each endpoint. Six of the nine examples fail on main and pass with this change; the other three are controls. The existing request specs for these controllers and the court report specs pass.

Behaviour change: a case from another org used to end in a Pundit denial (emancipations), a cross-org write (case assignments) or a 500 (copy_court_orders with an unknown number); these now return 404.

Screenshots please :)

No UI change.

[compwron]

Thanks @A-RYAN-1, this is a really clean change, and the request spec with two orgs sharing a case number is exactly the right test. CI is red on 3 older examples in spec/controllers/emancipations_controller_spec.rb (lines 42, 72, 223) that still expect the old "not authorized" redirect / 401 for another org's case. With the scoped lookup that's now a 404, which I think is the better behavior (it doesn't reveal the case exists). Could you update those to expect :not_found, and remove #not_authorized if nothing else uses it? Then this is good to merge.

[compwron]

Specs need fixing, but the approach looks good :)

[A-RYAN-1]

Pushed 59afcb1: the three examples now expect 404, and the full spec/controllers and spec/requests run passes locally (1052 examples, 0 failures). I kept #not_authorized because an unassigned volunteer in the same org still reaches it, so the last example now covers that case.