is: Add restriction test to organization registry

pkg/identityserver/organization_registry_test.go

@@ -213,6 +213,32 @@ func TestOrganizationsCRUD(t *testing.T) {
  a.So(updated.Name, should.Equal, "Updated Name")
  }
 
+ t.Run("contact_info_restriction", func(t *testing.T) { // nolint:paralleltest
+ a, ctx := test.New(t)
+ is.config.Restrictions.Entity.RestrictContacts = true
+ t.Cleanup(func() { is.config.Restrictions.Entity.RestrictContacts = false })
+
+ _, err := reg.Update(ctx, &ttnpb.UpdateOrganizationRequest{
+ Organization: &ttnpb.Organization{
+ Ids: created.GetIds(),
+ Name: "Updated Name",
+ AdministrativeContact: usr2.GetOrganizationOrUserIdentifiers(),
+ },
+ FieldMask: ttnpb.FieldMask("name"),
+ }, creds)
+ a.So(errors.IsPermissionDenied(err), should.BeTrue)
+
+ _, err = reg.Update(ctx, &ttnpb.UpdateOrganizationRequest{
+ Organization: &ttnpb.Organization{
+ Ids: created.GetIds(),
+ Name: "Updated Name",
+ TechnicalContact: usr2.GetOrganizationOrUserIdentifiers(),
+ },
+ FieldMask: ttnpb.FieldMask("name"),
+ }, creds)
+ a.So(errors.IsPermissionDenied(err), should.BeTrue)
+ })
+
  for _, collaborator := range []*ttnpb.OrganizationOrUserIdentifiers{nil, usr1.GetOrganizationOrUserIdentifiers()} {
  list, err := reg.List(ctx, &ttnpb.ListOrganizationsRequest{
  FieldMask: ttnpb.FieldMask("name"),