fix(llmo): guard createOrFindSite from moving site with active enroll…

src/controllers/llmo/llmo-onboarding.js

@@ -996,6 +996,10 @@ export async function createOrFindSite(baseURL, organizationId, context, deliver
   const site = await Site.findByBaseURL(baseURL);
   if (site) {
     if (site.getOrganizationId() !== organizationId) {
+      const enrollments = await site.getSiteEnrollments();
+      if (enrollments?.length > 0) {
+        throw new Error(`Site ${baseURL} is already associated with another org that has active products and cannot be moved.`);
+      }
       site.setOrganizationId(organizationId);
       // Persist the re-parent immediately. resolveLlmoOnboardingMode (called
       // right after this in performLlmoOnboarding) reads sites by org_id, so

test/controllers/llmo/llmo-onboarding.test.js

@@ -1237,6 +1237,7 @@ describe('LLMO Onboarding Functions', () => {
       const mockSite = {
         getOrganizationId: sinon.stub().returns('old-org-123'),
         setOrganizationId: sinon.stub(),
+        getSiteEnrollments: sinon.stub().resolves([]),
         save: sinon.stub().resolves(),
       };
 
@@ -1256,6 +1257,38 @@ describe('LLMO Onboarding Functions', () => {
       // queries Site.allByOrganizationId, otherwise a legacy site moved into a
       // brand-new org would be misclassified as v2.
       expect(mockSite.save).to.have.been.calledOnce;
+    }).timeout(5000);
+
+    it('should throw when existing site has different org and active enrollments', async () => {
+      const { createOrFindSite } = await esmock('../../../src/controllers/llmo/llmo-onboarding.js', {
+        '@adobe/spacecat-shared-data-access/src/models/entitlement/index.js': {
+          Entitlement: {
+            PRODUCT_CODES: { LLMO: 'LLMO' },
+            TIERS: { FREE_TRIAL: 'FREE_TRIAL' },
+          },
+        },
+        '@adobe/spacecat-shared-tier-client': {
+          default: sinon.stub(),
+        },
+      });
+
+      const mockSite = {
+        getOrganizationId: sinon.stub().returns('other-org-789'),
+        setOrganizationId: sinon.stub(),
+        getSiteEnrollments: sinon.stub().resolves([{ getId: () => 'enroll-1' }]),
+        save: sinon.stub().resolves(),
+      };
+
+      mockDataAccess.Site.findByBaseURL.resolves(mockSite);
+
+      const context = { dataAccess: mockDataAccess };
+
+      await expect(
+        createOrFindSite('https://example.com', 'new-org-456', context),
+      ).to.be.rejectedWith('already associated with another org that has active products');
+
+      expect(mockSite.setOrganizationId).to.not.have.been.called;
+      expect(mockSite.save).to.not.have.been.called;
     });
 
     it('should not update organization ID when existing site has same organization', async () => {

test/support/slack/actions/onboard-llmo-modal.test.js

@@ -55,6 +55,7 @@ describe('onboard-llmo-modal', () => {
         getImports: sinonSandbox.stub().returns([]),
       }),
       setConfig: sinonSandbox.stub(),
+      getSiteEnrollments: sinonSandbox.stub().resolves([]),
       save: sinonSandbox.stub().resolves(),
     };
   };