Scope signing user picker to team for multi-tenant SaaS (#6583)

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -1005,6 +1005,10 @@ public class ApplicationProperties {
         @Data
         public static class Signing {
             private boolean enabled = false;
+
+            // Signing user-picker scope: 'org' (default) = whole instance, anything else =
+            // caller's team only (fail-closed). The saas profile pins 'team'.
+            private String userListScope = "org";
         }
     }
 

app/common/src/test/java/stirling/software/common/model/ApplicationPropertiesLogicTest.java

@@ -31,6 +31,22 @@ class ApplicationPropertiesLogicTest {
         assertTrue(sys.isAnalyticsEnabled());
     }
 
+    @Test
+    void storageSigning_userListScope_defaultsToOrg_andIsSettable() {
+        // Self-host backward-compat: scope must default to "org" (saas profile pins "team").
+        ApplicationProperties.Storage.Signing signing = new ApplicationProperties.Storage.Signing();
+
+        assertFalse(signing.isEnabled());
+        assertEquals("org", signing.getUserListScope());
+
+        signing.setUserListScope("team");
+        assertEquals("team", signing.getUserListScope());
+
+        // Reachable from the full tree as storage.signing.userListScope.
+        assertEquals(
+                "org", new ApplicationProperties().getStorage().getSigning().getUserListScope());
+    }
+
     @Test
     void tempFileManagement_defaults_and_overrides() {
         Function<String, String> normalize = s -> Paths.get(s).normalize().toString();