GET /api/organizations/:org_id/fieldforce/...
  ↓
FieldforceFeatureFlagMiddleware
  1. Query admin_feature_flags WHERE key = 'fieldforce'
     → row exists AND is_enabled = false → 403 "Fieldforce is globally disabled"
     → row missing OR is_enabled = true → continue
  2. Query org_feature_flags WHERE org_id = ? AND key = 'fieldforce'
     → row exists AND enabled = false → 403 "Fieldforce not enabled for this organization"
     → row missing OR enabled = true → allow request
  3. DB error at any point → log error, allow request (fail-open)

-- Global (existing table)
admin_feature_flags(key text PK, is_enabled bool NOT NULL)

-- Per-org (new table, migration 004)
org_feature_flags(id uuid PK, org_id text, key text, enabled bool DEFAULT true)
UNIQUE (org_id, key)

// Checking only the org flag — misses the global kill-switch
func FeatureFlagMiddleware(db *gorm.DB) echo.MiddlewareFunc {
    return func(next echo.HandlerFunc) echo.HandlerFunc {
        return func(c echo.Context) error {
            orgID := c.Param("org_id")
            var flag OrgFeatureFlag
            db.Where("org_id = ? AND key = 'fieldforce'", orgID).First(&flag)
            if !flag.Enabled { return echo.ErrForbidden } // wrong — skips global check
            return next(c)
        }
    }
}

// Failing closed on DB error
if err := db.Find(&flag).Error; err != nil {
    return echo.ErrInternalServerError // wrong — should fail open and log
}

func FieldforceFeatureFlagMiddleware(db *gorm.DB, log *logger.Logger) echo.MiddlewareFunc {
    return func(next echo.HandlerFunc) echo.HandlerFunc {
        return func(c echo.Context) error {
            // 1. Global flag
            var global AdminFeatureFlag
            if err := db.Where("key = 'fieldforce'").First(&global).Error; err == nil {
                if !global.IsEnabled {
                    return echo.NewHTTPError(403, "Fieldforce is globally disabled")
                }
            } else if !errors.Is(err, gorm.ErrRecordNotFound) {
                log.Error("flag check failed", zap.Error(err)) // fail open
            }

            // 2. Org flag
            orgID := c.Param("org_id")
            var orgFlag OrgFeatureFlag
            if err := db.Where("org_id = ? AND key = 'fieldforce'", orgID).First(&orgFlag).Error; err == nil {
                if !orgFlag.Enabled {
                    return echo.NewHTTPError(403, "Fieldforce not enabled for this organization")
                }
            } else if !errors.Is(err, gorm.ErrRecordNotFound) {
                log.Error("org flag check failed", zap.Error(err)) // fail open
            }

            return next(c)
        }
    }
}