Cloud API scopes by the URL org header, with session as fallback

Org-scoped requests carry the active org in an x-executor-organization header (a slug or org_ id); the server resolves it against live WorkOS membership and scopes to it, falling back to the session's own org when absent. Additive and backward-compatible — existing cookie-only callers keep working via the fallback. The header is a selector, not a trust boundary (membership is always re-checked), mirroring the MCP plane. This is the server half of moving off cookie-based 'active org': once the web client sends its URL's org per request, two browser tabs on different orgs scope independently instead of fighting over one shared cookie. Covers the executor data plane (workos-auth-provider) and the account plane (members/api-keys/me). The domains plane stays session-scoped: its HttpApiMiddleware security handler may carry no residual requirement, so it can't reach the per-request UserStoreService a slug needs — noted for a follow-up that converts it to an HttpRouter middleware.

Rhys Sullivan committed 5 months ago

Commit be7f2df1 parent e48bff76 files · +230 −33Browse files

Unified · Split

6 files

apps/cloud/src/account/workos-account-service.ts +37 −29
apps/cloud/src/api/layers.ts +1 −1
apps/cloud/src/auth/middleware-live.ts +7 −0
apps/cloud/src/auth/org-selector-auth.node.test.ts +129 −0
apps/cloud/src/auth/organization.ts +41 −0
apps/cloud/src/auth/workos-auth-provider.ts +15 −3

apps/cloud/src/account/workos-account-service.ts+37−29

 import { Context, Effect, Layer } from "effect";
-import { AccountProvider } from "@executor-js/api/server";
+import { AccountProvider, type AccountHeaders } from "@executor-js/api/server";
 import {
   AccountError,
   AccountForbidden,
 import { UserStoreService } from "../auth/context";
 import type { Session } from "../auth/middleware";
 import { WorkOSClient } from "../auth/workos";
-import { authorizeOrganization } from "../auth/organization";
+import { ORG_SELECTOR_HEADER, authorizeOrganizationSelector } from "../auth/organization";
 import { AutumnService } from "../extensions/billing/service";
 import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "../extensions/billing/plans";
         ? Effect.succeed(caller.session)
         : Effect.fail<AccountUnauthorized>(new AccountUnauthorized());
-    // Like cloud's `requireSessionOrganization`: an authenticated session that
+    // The org scope for an org-scoped request: the console URL's org (sent in
-    // currently holds an active membership in its session org. Yields the
+    // the selector header) when present, else the session's own org. Membership
-    // session + resolved org, or AccountNoOrganization.
+    // is re-checked live, so the header is a selector, not a trust boundary —
-    const requireOrganization = () =>
+    // and two browser tabs on different orgs each send their own header, so
+    // they stay independent (see organization.ts). Yields the session +
+    // resolved org, or AccountNoOrganization.
+    const requireOrganization = (headers: AccountHeaders) =>
       Effect.gen(function* () {
         const session = yield* requireSession();
-        if (!session.organizationId) {
+        const selector = headers[ORG_SELECTOR_HEADER] ?? session.organizationId;
+        if (!selector) {
           return yield* new AccountNoOrganization();
         }
-        const org = yield* authorizeOrganization(session.accountId, session.organizationId).pipe(
+        const org = yield* authorizeOrganizationSelector(session.accountId, selector).pipe(
           Effect.provideContext(ctx),
           Effect.mapError(() => new AccountNoOrganization()),
         );
       });
     return AccountProvider.of({
-      me: () =>
+      me: (headers) =>
         Effect.gen(function* () {
           const session = yield* requireSession();
-          const org = session.organizationId
+          // Same selector precedence as requireOrganization: the URL's org
-            ? yield* authorizeOrganization(session.accountId, session.organizationId).pipe(
+          // (header) drives /account/me so the shell reflects the org the tab
+          // is viewing, not a session-global active org.
+          const selector = headers[ORG_SELECTOR_HEADER] ?? session.organizationId;
+          const org = selector
+            ? yield* authorizeOrganizationSelector(session.accountId, selector).pipe(
                 Effect.provideContext(ctx),
                 Effect.orElseSucceed(() => null),
               )
           };
         }),
-      listApiKeys: () =>
+      listApiKeys: (headers) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           const keys = yield* apiKeys
             .listUserKeys({ accountId: session.accountId, organizationId: org.id })
             .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError));
           return { apiKeys: keys };
         }),
-      createApiKey: (_headers, name) =>
+      createApiKey: (headers, name) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           const trimmed = name.trim().slice(0, MAX_API_KEY_NAME_LENGTH);
           if (!trimmed) {
             return yield* new AccountError({ message: "API key name is required" });
             .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError));
         }),
-      revokeApiKey: (_headers, apiKeyId) =>
+      revokeApiKey: (headers, apiKeyId) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           const ownedKeys = yield* apiKeys
             .listUserKeys({ accountId: session.accountId, organizationId: org.id })
             .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError));
           return { success: true };
         }),
-      listMembers: () =>
+      listMembers: (headers) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           // Seats fall back to safe display defaults on lookup error — never
           // blank the page over a transient Autumn/WorkOS hiccup. The real cap
           return { members, seats };
         }),
-      listRoles: () =>
+      listRoles: (headers) =>
         Effect.gen(function* () {
-          const { org } = yield* requireOrganization();
+          const { org } = yield* requireOrganization(headers);
           const result = yield* workos
             .listOrgRoles(org.id)
             .pipe(Effect.catchTag("WorkOSError", toAccountError));
           };
         }),
-      inviteMember: (_headers, body) =>
+      inviteMember: (headers, body) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           yield* requireAdmin(session.accountId, org.id);
           yield* reserveMemberSlot(org.id);
           const invitation = yield* workos
           return { id: invitation.id, email: invitation.email };
         }),
-      removeMember: (_headers, membershipId) =>
+      removeMember: (headers, membershipId) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           yield* requireAdmin(session.accountId, org.id);
           yield* assertMembershipInOrg(org.id, membershipId);
           yield* workos
           return { success: true };
         }),
-      updateMemberRole: (_headers, membershipId, roleSlug) =>
+      updateMemberRole: (headers, membershipId, roleSlug) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           yield* requireAdmin(session.accountId, org.id);
           yield* assertMembershipInOrg(org.id, membershipId);
           yield* workos
           return { success: true };
         }),
-      updateOrgName: (_headers, name) =>
+      updateOrgName: (headers, name) =>
         Effect.gen(function* () {
-          const { session, org } = yield* requireOrganization();
+          const { session, org } = yield* requireOrganization(headers);
           yield* requireAdmin(session.accountId, org.id);
           const updated = yield* workos
             .updateOrganization(org.id, name)

apps/cloud/src/api/layers.ts+1−1

@@ -67,7 +67,7 @@ export const makeNonProtectedApiLive = (rsLive: Layer.Layer<DbService \| UserStor · 66 unmodified lines
67	// `getDomainVerificationLink` handler also gates on billing, so	67	// `getDomainVerificationLink` handler also gates on billing, so
68	// `AutumnService.Default` is provided HERE (not on the neutral boot core).	68	// `AutumnService.Default` is provided HERE (not on the neutral boot core).
69	// Unlike the member endpoints that used to live here, they need no per-request	69	// Unlike the member endpoints that used to live here, they need no per-request
70	// DB scoping.	70	// DB scoping (and `OrgAuthLive` stays session-scoped — see its note).
71	export const OrgApiLive = HttpApiBuilder.layer(OrgHttpApi).pipe(	71	export const OrgApiLive = HttpApiBuilder.layer(OrgHttpApi).pipe(
72	Layer.provide(OrgHandlers),	72	Layer.provide(OrgHandlers),
73	Layer.provideMerge(OrgAuthLive),	73	Layer.provideMerge(OrgAuthLive),

apps/cloud/src/auth/middleware-live.ts+7−0

@@ -85,6 +85,13 @@ export const OrgAuthLive = Layer.effect( · 84 unmodified lines
85	return yield* Effect.fail(new NoOrganization());	85	return yield* Effect.fail(new NoOrganization());
86	}	86	}
87		87
		88	// NOTE: the domains plane stays scoped to the SESSION org, not the URL
		89	// org. Unlike the data + account planes (which resolve the selector
		90	// header), this `HttpApiMiddleware` security handler may carry no
		91	// residual requirement, so it can't reach the per-request
		92	// `UserStoreService` a slug→id resolution needs. The domains surface
		93	// (org-settings → domain verification) is niche; URL-scoping it would
		94	// mean converting this to an HttpRouter middleware — deferred.
88	const session = sessionFromSealed(result, Redacted.value(credential));	95	const session = sessionFromSealed(result, Redacted.value(credential));
89	const auth = {	96	const auth = {
90	accountId: session.accountId,	97	accountId: session.accountId,

apps/cloud/src/auth/org-selector-auth.node.test.ts+129−0

@@ -0,0 +1,129 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { Effect, Layer } from "effect";
	3
	4	import { ApiKeyService } from "./api-keys";
	5	import { UserStoreService } from "./context";
	6	import { resolveSessionPrincipal } from "./workos-auth-provider";
	7	import { WorkOSClient, type WorkOSClientService } from "./workos";
	8
	9	// The org a console request resolves to is the URL's org (sent in the
	10	// `x-executor-organization` selector header), not the session's stored org —
	11	// with the session org as the fallback for non-console callers, and live
	12	// membership re-checked either way. This is what makes two browser tabs on
	13	// different orgs independent.
	14
	15	const createdAt = new Date("2026-01-01T00:00:00.000Z");
	16
	17	// user_session belongs to BOTH orgs; the URL selects which one a request hits.
	18	const MEMBER = "user_session";
	19	const SESSION_ORG = "org_session";
	20	const URL_ORG = "org_url";
	21	const URL_SLUG = "acme";
	22
	23	const stubApiKeys = Layer.succeed(ApiKeyService)({
	24	// No Authorization header in these tests → the api-key path returns null and
	25	// resolution falls through to the session path.
	26	validate: () => Effect.succeed(null),
	27	listUserKeys: () => Effect.succeed([]),
	28	createUserKey: () => Effect.die("not used"),
	29	revokeUserKey: () => Effect.void,
	30	});
	31
	32	const stubWorkOS = Layer.succeed(
	33	WorkOSClient,
	34	new Proxy({} as WorkOSClientService, {
	35	get: (_t, prop) => {
	36	if (prop === "authenticateRequest") {
	37	return () =>
	38	Effect.succeed({ userId: MEMBER, email: "u@e2e.test", organizationId: SESSION_ORG });
	39	}
	40	if (prop === "listUserMemberships") {
	41	return (userId: string) =>
	42	Effect.succeed({
	43	data:
	44	userId === MEMBER
	45	? [
	46	{ userId, organizationId: SESSION_ORG, status: "active" },
	47	{ userId, organizationId: URL_ORG, status: "active" },
	48	]
	49	: [],
	50	});
	51	}
	52	return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);
	53	},
	54	}),
	55	);
	56
	57	const stubUsers = Layer.succeed(UserStoreService)({
	58	use: (fn) =>
	59	Effect.promise(() =>
	60	fn({
	61	ensureAccount: async (id: string) => ({ id, createdAt }),
	62	getAccount: async (id: string) => ({ id, createdAt }),
	63	upsertOrganization: async (org: { id: string; name: string }) => ({
	64	...org,
	65	slug: null,
	66	createdAt,
	67	}),
	68	getOrganization: async (id: string) => ({ id, name: `Org ${id}`, slug: id, createdAt }),
	69	// The URL slug maps to URL_ORG (the member's other org); any other slug
	70	// maps to an org the caller is NOT a member of, so membership rejects it.
	71	getOrganizationBySlug: async (slug: string) => ({
	72	id: slug === URL_SLUG ? URL_ORG : "org_outsider",
	73	name: `Org ${slug}`,
	74	slug,
	75	createdAt,
	76	}),
	77	ensureOrganizationSlug: async (org: { id: string; name: string; slug: string \| null }) => ({
	78	...org,
	79	slug: org.slug ?? org.id,
	80	createdAt,
	81	}),
	82	}),
	83	),
	84	});
	85
	86	const run = (headers: Record<string, string>) =>
	87	resolveSessionPrincipal(new Request("https://executor.test/api/tools", { headers })).pipe(
	88	Effect.provide(Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers)),
	89	);
	90
	91	describe("resolveSessionPrincipal · URL org selector", () => {
	92	it.effect("falls back to the session org when no selector header is sent", () =>
	93	Effect.gen(function* () {
	94	const principal = yield* run({ cookie: "wos-session=x" });
	95	expect(principal.organizationId, "scopes to the session org").toBe(SESSION_ORG);
	96	}),
	97	);
	98
	99	it.effect("scopes to the URL org (by slug) over the session org", () =>
	100	Effect.gen(function* () {
	101	const principal = yield* run({
	102	cookie: "wos-session=x",
	103	"x-executor-organization": URL_SLUG,
	104	});
	105	expect(principal.organizationId, "the slug header wins over the session org").toBe(URL_ORG);
	106	}),
	107	);
	108
	109	it.effect("accepts a WorkOS org id as the selector too", () =>
	110	Effect.gen(function* () {
	111	const principal = yield* run({
	112	cookie: "wos-session=x",
	113	"x-executor-organization": URL_ORG,
	114	});
	115	expect(principal.organizationId).toBe(URL_ORG);
	116	}),
	117	);
	118
	119	it.effect("rejects a selector for an org the caller is not a member of", () =>
	120	Effect.gen(function* () {
	121	// The slug resolves to a real org id, but membership is re-checked — a
	122	// slug is a selector, not a trust boundary, so a non-member is rejected.
	123	const error = yield* Effect.flip(
	124	run({ cookie: "wos-session=x", "x-executor-organization": "outsider-slug" }),
	125	);
	126	expect(error).toMatchObject({ _tag: "NoOrganization" });
	127	}),
	128	);
	129	});

apps/cloud/src/auth/organization.ts+41−0

@@ -79,3 +79,44 @@ export const authorizeOrganization = (userId: string, organizationId: string) => · 78 unmodified lines
79		79
80	return yield* resolveOrganization(organizationId);	80	return yield* resolveOrganization(organizationId);
81	});	81	});
		82
		83	// ---------------------------------------------------------------------------
		84	// Org SELECTOR — the URL is the scope authority, not the session.
		85	// ---------------------------------------------------------------------------
		86	//
		87	// Org-scoped requests carry the active org in this header, set by the web
		88	// client from the console URL's slug (the MCP plane carries the same idea in
		89	// its own `x-executor-mcp-organization`). The selector is a slug (`acme`, the
		90	// readable URL form) or a WorkOS id (`org_…`, the legacy/token form). It is a
		91	// SELECTOR, not a trust boundary: `authorizeOrganizationSelector` re-checks
		92	// live membership, so the worst a forged header does is name an org the caller
		93	// already belongs to.
		94	//
		95	// Why a header and not the session's `org_id`: a browser shares ONE cookie jar
		96	// across tabs, so a single session-pinned org makes "active org" a
		97	// browser-global — two tabs can't be in two orgs at once, and switching in one
		98	// silently re-scopes the other. Scoping per-request from the URL makes each
		99	// tab independent.
		100
		101	export const ORG_SELECTOR_HEADER = "x-executor-organization";
		102
		103	/** The URL-pinned org selector for a request, or `null` to fall back to the session. */
		104	export const orgSelectorFromRequest = (request: Request): string \| null =>
		105	request.headers.get(ORG_SELECTOR_HEADER);
		106
		107	/**
		108	* Resolve an org SELECTOR (URL slug or `org_…` id) to the organization the
		109	* caller actively belongs to, or `null`. A slug resolves through the local
		110	* mirror to its id first; ids pass straight through. Either way membership is
		111	* verified live via {@link authorizeOrganization}.
		112	*/
		113	export const authorizeOrganizationSelector = (userId: string, selector: string) =>
		114	Effect.gen(function* () {
		115	if (selector.startsWith("org_")) {
		116	return yield* authorizeOrganization(userId, selector);
		117	}
		118	const users = yield* UserStoreService;
		119	const org = yield* users.use((s) => s.getOrganizationBySlug(selector));
		120	if (!org) return null;
		121	return yield* authorizeOrganization(userId, org.id);
		122	});

apps/cloud/src/auth/workos-auth-provider.ts+15−3

 import { ApiKeyService } from "./api-keys";
 import { BEARER_PREFIX } from "./bearer";
-import { authorizeOrganization } from "./organization";
+import {
+  authorizeOrganization,
+  authorizeOrganizationSelector,
+  orgSelectorFromRequest,
+} from "./organization";
 import { UserStoreService } from "./context";
 import { sealedSessionDisplayName } from "./middleware";
 import type { UserStoreError, WorkOSError } from "./errors";
   Effect.gen(function* () {
     const workos = yield* WorkOSClient;
     const session = yield* workos.authenticateRequest(request);
-    if (!session || !session.organizationId) {
+    if (!session) {
+      return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);
+    }
+    // The console URL's org is the scope authority (sent as a header); the
+    // session's own org is the fallback for non-console callers. Membership is
+    // re-checked live either way — the header is a selector, not a trust
+    // boundary (see organization.ts).
+    const selector = orgSelectorFromRequest(request) ?? session.organizationId;
+    if (!selector) {
       return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);
     }
-    const org = yield* authorizeOrganization(session.userId, session.organizationId);
+    const org = yield* authorizeOrganizationSelector(session.userId, selector);
     if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);
     return {
       accountId: session.userId,