Repository navigation
fix: authorize org routes by membership; drop CurrentUser.organizationId - #374
Confidence 7/10 · 1 issue to address
🟢 Confidence 7/10 · likely safe to merge. Untested authorization wiring on the org HTTP routes decides the number; requireMember itself is covered by cross-org.test.ts.
1 warning −1 · tests partial −1 · risk high −1
Replaces the dead CurrentUser.organizationId check on the integration and T3 Code routes with the directory membership check, and moves the web onto the route's organization. The fix is right and the deleted fallbacks were unreachable in production; nothing pins the new route guard.
requireOrgand three integration handlers authorize viarequireMember.CurrentUser.organizationIdgone from the domain and web session schemas.- Web subscriptions read
shared.organization.id; RPC org fallbacks dropped. - T3 Code gets a bundled logo in place of Brandfetch's
t3.chat.
Findings
🟠 Warning · F1 · No test pins that requireOrg admits a member and refuses an outsider
tests · apps/backend/src/routes/t3code.http.ts:115
The behavior this PR fixes — an org route answering a member whose session carries no organization — is exercised by no test. t3code.http.test.ts covers only checkCallback and requireT3CodeBot, so a return to an always-failing org check would pass CI again, as it did before.
Export `requireOrg` and test it against a seeded directory the way `cross-org.test.ts` does for `requireMember`: an active `membership_index` row passes, an outsider fails with `UnauthorizedError`.
What was checked
- No production code set the field: at base it is only ever
null/undefined(services/hazel-session.ts:59,rpc/middleware/auth.ts:133,routes/api-v1/bot-auth.ts:54). requireMemberrejects a missing or deletedmembership_indexrow (routes/integration-resources.http.ts:43).- The bot routes (
getT3CodeAccess,reportT3CodeExpired) keeprequireT3CodeBotand were not touched.
afb91ae · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.
Annotations
Check warning on line 115 in apps/backend/src/routes/t3code.http.ts
maple-review-bot / Maple / review
tests: No test pins that `requireOrg` admits a member and refuses an outsider
The behavior this PR fixes — an org route answering a member whose session carries no organization — is exercised by no test. `t3code.http.test.ts` covers only `checkCallback` and `requireT3CodeBot`, so a return to an always-failing org check would pass CI again, as it did before.