[change] Enforce disabled-organization rules in firmware upgrades

[nemesifier]

Follow-up of openwisp/openwisp-users#522 and openwisp/openwisp-controller#1393. The device-operation decision matrix identifies disabled-organization handling that is still needed in openwisp-firmware-upgrader.

This complements #382, which tracks deactivated-device handling for firmware upgrade operations.

Expected Behavior

flowchart TD

    A["Organization Disabled<br/>is_active = False"]

    A --> B["Firmware Upgrade Request"]

    B --> C{"Organization Active?"}

    C -->|No| D["REJECT"]

    D --> D1["No upgrade created"]

    C -->|Yes| E["Create Upgrade Job"]

    E --> F["Worker Queue"]

    F --> G{"Organization Still Active?"}

    G -->|No| H["ABORT"]

    H --> H1["Do not execute upgrade"]

    G -->|Yes| I["Execute Upgrade"]

    I --> J["Result Aggregation"]

    J --> K["Exclude devices from disabled organizations"]

    A --> L["Historical Data"]

    L --> M["ALLOW"]

    M --> N["Read"]
    M --> O["Delete"]
    M --> P["Cleanup"]

Loading

When an organization is disabled, firmware upgrade write paths should not create or execute new activity for that organization. Read and cleanup operations should remain available when needed for auditability and consistency.

Work Items From The Matrix

• When a firmware category is shared, mass upgrade queries should exclude devices belonging to disabled organizations.
• If a category belongs to a disabled organization, initiating an upgrade should be rejected.
• Upgrade worker paths should re-check organization state when they start, so queued work cannot continue after the organization has been disabled.
• Result aggregation should not include devices from disabled organizations in active upgrade execution.
• Existing cleanup and historical reads should remain available.

Related Issues

• Disabled-organization base policy: [change] Make disabled organizations readonly but deletable openwisp-users#522
• Controller disabled-organization follow-up: [change] Limit controller operations on disabled organizations openwisp-controller#1393
• Firmware deactivated-device follow-up: [bug] Upgrade operations should not include deactivated devices #382

Acceptance Criteria

• Upgrade operations cannot be initiated for disabled-organization objects.
• Shared-category mass upgrades exclude devices from disabled organizations.
• Queued upgrade workers revalidate organization state before running.
• Read, delete, and cleanup paths remain available where needed.
• Tests cover active and disabled organization scenarios.

Reference: OpenWISP Device Operation Analysis