feat(web): select organization during plugin auth

[MaheshtheDev]

Summary

Add organization selection to the production plugin authorization flow, following the existing MCP consent pattern so users choose the destination organization before approving access.

Changes

• Validate plugin and callback parameters before /auth/connect performs onboarding or organization-selection transitions.
• Add a multi-organization selection step, single-organization auto-entry, and a Change action on the approval screen.
• Preserve existing plugin identity, feature descriptions, callback behavior, onboarding handling, and multi-client support.
• Send the locally selected organization ID during key issuance and preserve the current selection when activation or issuance fails.
• Keep organization state unchanged when Better Auth rejects an activation request.

Testing

• ./node_modules/.bin/biome check apps/web/app/auth/connect/page.tsx packages/lib/auth-context.tsx — passed.
• git diff --check — passed.
• Web workspace typecheck — failed on pre-existing unrelated files; neither changed file appeared in diagnostics.
• Browser verification passed for invalid callbacks, unsupported clients, and unauthenticated deep-link preservation.
• Authenticated multi-organization selection and approval were not run because no authenticated browser state or disposable organization fixtures were available.

---

Attached Images and Videos

🎥 View recording: plugin-auth-invalid-request-local.webm

🎥 View recording: plugin-auth-unauth-boundaries.webm

[plugin-auth-supermemory-biome.log]

[plugin-auth-supermemory-web-types.log]

---

Session Details

• Session: View Session
• Requested by: Mahesh Sanikommu (mahesh@supermemory.com)
• Address comments on this PR. Add (aside) to your comment to have me ignore it.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	0a90d46	Aug 28 2026, 11:56 PM

[MaheshtheDev]

• feat(web): select organization during plugin auth #1590 👈 (View in Graphite)
• main

---

How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	0a90d46	Commit Preview URL Branch Preview URL	Aug 28 2026, 11:58 PM

[claude]

Claude finished @vorflux[bot]'s task in 1m 50s —— View job

---

Code Review Complete

• Get PR diff and understand changes
• Check existing review comments (none found)
• Read changed files with surrounding context
• Analyze for bugs, security issues, and logic errors
• Submit review

Result: No issues found. The PR adds organization selection to the plugin authorization flow with proper security boundaries (localhost callback validation, key prefix verification), clean state management, and defensive error handling.

Score: 10/10 — Ready to ship.

[claude]

Overview: Adds organization selection to the plugin authorization flow, allowing users to choose which organization to connect plugins to before approving access.

Issues found: None — this looks good to ship.

Analysis:

• Security: Callback URLs are properly restricted to localhost via isValidLocalhostCallback (lines 25-36). The key prefix validation (lines 364-371) provides defense-in-depth to ensure returned keys belong to the expected organization.

• State management: The status flow (loading → selection/approval → creating → success) is well-defined. Edge cases are handled correctly:

  • Selected organization removal is detected and gracefully recovers to selection (lines 301-312)
  • The selectedOrg derivation from organizations (lines 239-241) ensures stale org IDs return null, which is caught in handleConnect
  • Single-org users skip selection and go directly to approval (lines 283-289)

• Error handling: Promise.allSettled correctly separates successes from failures when issuing keys for multiple clients. Errors return the user to the appropriate state (selection or approval) rather than a dead-end error screen.

• Request validation: Moved to a computed requestError useMemo (lines 230-238) which is cleaner than the previous effect-based approach and shows the error immediately.

Score: 10/10

Clean, defensive code with proper security boundaries and edge case handling.

[yesprasad]

@MaheshtheDev @Dhravya @sohamd22

DeepGraph independently traced the changed symbols in apps/web/app/auth/connect/page.tsx and found that the updated authentication flow is also reached through apps/web/app/auth/agent-connect/page.tsx, which re-exports the changed page.
TypeScript resolution completed across the Bun/Turborepo
workspace: 1
1 projects discovered,
49 workspace imports resolved,
and 0 unresolved imports.

Please include both /auth/connect and /auth/agent-connect entry points when validating organization selection, callback redirects, and organization-specific key creation.
note: This is an evidence-based consequence check, not an additional claim that the implementation is defective.

[claude]

Overview: Adds organization selection to the plugin authorization flow, allowing users to choose which organization to connect plugins to before approving access.

Issues found: None — this looks good to ship.

Analysis:

• Security: Callback URLs are properly restricted to localhost via isValidLocalhostCallback (lines 25-36), which validates hostname, protocol, and path. The key prefix validation (lines 351-358) provides defense-in-depth to ensure returned keys belong to the expected organization.

• State management: The status flow (loading → selection → approval → creating → success) is well-defined. Edge cases are handled correctly:

  • Selected organization removal is detected and gracefully recovers to selection (lines 280-292)
  • The selectedOrg derivation from organizations ensures stale org IDs return null, which is caught in handleConnect
  • Single-org users benefit from the flow continuing appropriately based on multiOrg

• Error handling: Promise.allSettled correctly separates successes from failures when issuing keys for multiple clients. Errors return the user to the appropriate state (selection or approval) rather than a dead-end error screen.

• Request validation: Moved to a computed requestError useMemo (lines 230-238) which validates upfront and shows errors immediately, preventing invalid requests from progressing.

• Middleware: Adding /auth/connect and /auth/agent-connect to public paths is correct since unauthenticated users need to access these pages to be redirected to login.

Score: 10/10

Clean, defensive code with proper security boundaries and edge case handling.