fix(auth): clamp sessions created before their member row exists

Two defects found by an independent audit of the session lifecycle.

1. First SSO sign-in into a policy-bearing org produced an UNCLAMPED 30-day
   session. `@better-auth/sso` creates the session before it writes `member`
   (`handleOAuthUserInfo` then `assignOrganizationFromProvider`), and it writes
   through the adapter directly, so no member hook fires. The create hook saw no
   membership and applied Better Auth's default expiry — and because a 30-day
   expiry reads as "not due for refresh", the sliding refresh would not re-clamp
   it for another day. Against an 8-hour policy that is a full day of bypass, on
   every first SSO login, deterministically.

   Closed with an `after` hook that re-applies the policy once membership is
   visible. It runs only for sessions created without an org — the only ones
   that can be affected — and is best-effort so it can never break sign-in.

2. The create hook's catch branched on a local that was stale by the time it was
   read. When the direct membership read failed, `clampExpiryForSession` could
   still resolve the org from cache and then throw on the policy read; the catch
   saw the stale `undefined` and took the permissive branch — failing OPEN on a
   path whose comment promised fail-closed. Membership is now resolved once, up
   front, through the shared cached helper, and both the clamp and the catch use
   that single value.

Also: normalize the update hook's fallback expiry like its happy path, and
correct the `getSessionPolicy` cost note — an org with bounds stored pays the
entitlement check too, so roughly four reads, not one.

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -34,8 +34,12 @@ import {
 import { getAccessControlConfig, isEmailBlockedByAccessControl } from '@/lib/auth/access-control'
 import { createAnonymousSession, ensureAnonymousUserExists } from '@/lib/auth/anonymous'
 import { getRequestedSignInProviderId, isSignInProviderAllowed } from '@/lib/auth/constants'
-import { getSessionCookieCacheVersion } from '@/lib/auth/security-policy'
-import { clampExpiryForSession } from '@/lib/auth/session-policy'
+import {
+  getMemberOrganizationId,
+  getSessionCookieCacheVersion,
+  invalidateMembershipCache,
+} from '@/lib/auth/security-policy'
+import { applySessionPolicyToNewMember, clampExpiryForSession } from '@/lib/auth/session-policy'
 import { guardSubscriptionPlanWrites } from '@/lib/auth/stripe-adapter-guard'
 import { sendPlanWelcomeEmail } from '@/lib/billing'
 import {
@@ -661,28 +665,29 @@ export const auth = betterAuth({
             }
           }
 
-          // Resolved separately from the clamp below so the two failures stay
-          // distinguishable: `null` means "confirmed not in an org", while
-          // `undefined` means "could not tell". The clamp retries through the
-          // membership cache, and the catch below branches on which one it got.
-          let membershipOrgId: string | null | undefined
+          // Membership is resolved ONCE, here, and the clamp is handed the
+          // result. Resolving it in two places let the catch below branch on a
+          // stale local while the clamp had actually resolved the org from
+          // cache — failing open on a path documented as failing closed.
+          let membershipOrgId: string | null
           try {
-            const members = await db
-              .select({ organizationId: schema.member.organizationId })
-              .from(schema.member)
-              .where(eq(schema.member.userId, session.userId))
-              .limit(1)
-            membershipOrgId = members[0]?.organizationId ?? null
+            membershipOrgId = await getMemberOrganizationId(session.userId)
             logger.info(
               membershipOrgId ? 'Found organization for user' : 'No organizations found for user',
               { userId: session.userId, organizationId: membershipOrgId ?? undefined }
             )
           } catch (error) {
-            logger.error('Could not resolve organization for new session', {
+            // The governing org is genuinely unknown, so a member is
+            // indistinguishable from the majority of users who belong to no org.
+            // Failing closed would take authentication down for everyone to
+            // protect a policy most of them do not have. Allow, unclamped: the
+            // after-hook above re-applies the policy once membership resolves,
+            // and the update hook clamps retroactively from `createdAt`.
+            logger.error('Could not resolve organization for new session; session not clamped', {
               error,
               userId: session.userId,
             })
-            membershipOrgId = undefined
+            return { data: session }
           }
 
           try {
@@ -698,15 +703,15 @@ export const auth = betterAuth({
               },
             }
           } catch (error) {
-            // Two different failures land here, and they get opposite answers.
-            //
-            // Org KNOWN: membership resolved, so this user is definitely
-            // governed by an org — only the policy read failed. Fail closed.
-            // The blast radius is org members during a window where the
-            // `organization` read fails but the `member` read just succeeded,
-            // which is narrow, loud, and self-clearing. Minting a full-length
-            // session for a member whose policy we could not read is the one
-            // outcome this feature exists to prevent.
+            // Membership already resolved above, so reaching here means only
+            // the POLICY read failed. For a member that is fail-closed: this
+            // user is definitely governed by an org, so the "would break
+            // sign-in for non-members too" argument does not apply. The blast
+            // radius is org members during a window where the `organization`
+            // read fails but the `member` read just succeeded — narrow, loud,
+            // and self-clearing. Minting a full-length session for a member
+            // whose policy we could not read is the one outcome this feature
+            // exists to prevent.
             if (membershipOrgId) {
               logger.error('Refusing session: org session policy could not be resolved', {
                 error,
@@ -718,17 +723,9 @@ export const auth = betterAuth({
               })
             }
 
-            // Org UNKNOWN: both the direct membership read and the cached
-            // fallback failed, so we cannot tell a governed member from the
-            // overwhelming majority of users who belong to no org at all.
-            // Failing closed here would turn a `member` read failure into a
-            // total authentication outage for everyone, to protect a policy
-            // that most of them do not have. Allow, and let it self-correct:
-            // the session takes the DB path at its next cookie-cache expiry
-            // and the update hook clamps it retroactively (the max-lifetime
-            // bound is measured from `createdAt`, so an over-long session
-            // expires immediately on that refresh). Any admin action bumps the
-            // security-policy version and closes the window at once.
+            // Confirmed non-member: the clamp short-circuits before any policy
+            // read for a null org, so this is defence in depth rather than a
+            // live path. A user with no org has no policy to violate, so allow.
             logger.error('Error clamping new session to org policy; session not clamped', {
               error,
               userId: session.userId,
@@ -764,7 +761,9 @@ export const auth = betterAuth({
               error,
               userId: current.userId,
             })
-            return { data: { ...data, expiresAt: current.expiresAt } }
+            // Normalized like the happy path above: Better Auth context values
+            // can cross a serialization boundary, and the column is a timestamp.
+            return { data: { ...data, expiresAt: new Date(current.expiresAt) } }
           }
         },
       },
@@ -1066,6 +1065,47 @@ export const auth = betterAuth({
 
       return
     }),
+    /**
+     * Re-applies the org session policy to a session that was created before
+     * its `member` row existed.
+     *
+     * SSO JIT provisioning does exactly that: the callback creates the session
+     * first and only then writes `member` straight through the adapter
+     * (`@better-auth/sso` calls `handleOAuthUserInfo` before
+     * `assignOrganizationFromProvider`, and bypasses the organization plugin's
+     * `addMember`, so no member hook fires). The session-create hook therefore
+     * sees no membership and mints Better Auth's full 30-day expiry — and
+     * because a 30-day expiry reads as "not due for refresh", the sliding
+     * refresh would not re-clamp it for another day. On a first SSO sign-in
+     * into an org with session bounds, that is a real policy bypass.
+     *
+     * Runs only for sessions created WITHOUT an org (the sole case that can be
+     * affected) and is best-effort — a failure here must never break sign-in.
+     */
+    after: createAuthMiddleware(async (ctx) => {
+      const created = ctx.context.newSession
+      if (!created?.session || created.session.activeOrganizationId) return
+      if ((created.session as { impersonatedBy?: string | null }).impersonatedBy) return
+
+      try {
+        // Drop the negative membership entry the create hook just cached, so
+        // the row written moments ago by the provisioning path is visible.
+        invalidateMembershipCache(created.user.id)
+        const organizationId = await getMemberOrganizationId(created.user.id)
+        if (!organizationId) return
+
+        logger.info('Applying org session policy to a session created pre-membership', {
+          userId: created.user.id,
+          organizationId,
+        })
+        await applySessionPolicyToNewMember(created.user.id, organizationId)
+      } catch (error) {
+        logger.error('Failed to apply org session policy after session creation', {
+          error,
+          userId: created.user.id,
+        })
+      }
+    }),
   },
   plugins: [
     ...(env.TURNSTILE_SECRET_KEY

apps/sim/lib/auth/security-policy.ts

@@ -105,7 +105,10 @@ export async function getSecurityPolicyVersion(
 }
 
 /**
- * Publishes the authoritative version a write just committed.
+ * Seeds THIS process with the version a write just committed. Other instances
+ * still pick it up on their own next read, so org-wide propagation remains
+ * bounded by {@link SECURITY_POLICY_VERSION_CACHE_TTL_MS} — this only removes
+ * the calling instance's own re-read.
  *
  * Deliberately a SET rather than a delete. Deleting would leave no floor for the
  * monotonic guard above, so a read that started before the bump could land

apps/sim/lib/auth/session-policy.ts

@@ -53,7 +53,14 @@ async function isEntitledToEnforce(organizationId: string): Promise<boolean> {
  * its stored rules at enforcement time (`lib/logs/execution/logger.ts`,
  * `lib/workflows/executor/execution-core.ts`). This is not a hot path: it runs
  * on sign-in and on a sliding session refresh, which the 24h cookie cache
- * limits to roughly once per user per day — one indexed point lookup each.
+ * limits to roughly once per user per day.
+ *
+ * Cost is one indexed lookup for an org with no bounds stored — the common
+ * case. An org that DOES store bounds additionally pays the entitlement check
+ * (owner lookup + block status + subscription), so about four reads. That is
+ * affordable per sign-in, but it lands all at once for every member when a
+ * policy save or org-wide revocation invalidates the whole org's cookie caches
+ * together; watch it if enterprise orgs grow much larger.
  *
  * A cache here is what made an earlier version of this code incorrect. Better
  * Auth rewrites `expiresAt` to `now + 30d` on every refresh, so a refresh that