-
Theme
-
- {THEME_OPTIONS.map((option) => {
- const isActive = option.value === themePreference;
- const Icon = option.icon;
-
- return (
- setThemePreference(option.value)}
- >
-
- );
- })}
-
+
+
+
+
Settings
+
+ {tabs.map((tab) => (
+
-
+
- {isHosted ? (
- <>
-
-
-
-
- Analytics
-
-
-
-
Help improve OpenSEO
-
- Share analytics and usage data.
-
-
-
{
- void updateAnalyticsPreference(event.currentTarget.checked);
- }}
- aria-label="Enable product analytics"
- />
-
-
- ) : (
-
- About
-
- Version
-
- v{version}
-
-
-
- )}
+
);
diff --git a/src/routes/_app/settings/index.tsx b/src/routes/_app/settings/index.tsx
new file mode 100644
index 0000000..e23ab89
--- /dev/null
+++ b/src/routes/_app/settings/index.tsx
@@ -0,0 +1,129 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { Monitor, Moon, Sun } from "lucide-react";
+import { useState } from "react";
+import { toast } from "sonner";
+import { ApiKeySettings } from "@/client/features/settings/ApiKeySettings";
+import { type ThemePreference, useThemePreference } from "@/client/lib/theme";
+import { authClient, useSession } from "@/lib/auth-client";
+import { isHostedClientAuthMode } from "@/lib/auth-mode";
+import { version } from "../../../../package.json";
+
+export const Route = createFileRoute("/_app/settings/")({
+ component: PersonalSettings,
+});
+
+const THEME_OPTIONS: {
+ value: ThemePreference;
+ label: string;
+ icon: typeof Sun;
+}[] = [
+ { value: "system", label: "System", icon: Monitor },
+ { value: "light", label: "Light", icon: Sun },
+ { value: "dark", label: "Dark", icon: Moon },
+];
+
+function PersonalSettings() {
+ const isHosted = isHostedClientAuthMode();
+ const { themePreference, setThemePreference } = useThemePreference();
+ const { data: session, isPending: isSessionPending } = useSession();
+ const [isSaving, setIsSaving] = useState(false);
+
+ const analyticsEnabled = session?.user?.analyticsOptedOut !== true;
+
+ async function updateAnalyticsPreference(enabled: boolean) {
+ setIsSaving(true);
+ try {
+ const result = await authClient.updateUser({
+ analyticsOptedOut: !enabled,
+ });
+ if (result.error) {
+ toast.error("We couldn't update your analytics setting.");
+ } else {
+ toast.success(enabled ? "Analytics enabled" : "Analytics disabled");
+ }
+ } catch {
+ toast.error("We couldn't update your analytics setting.");
+ } finally {
+ setIsSaving(false);
+ }
+ }
+
+ return (
+
+
+ Appearance
+
+
Theme
+
+ {THEME_OPTIONS.map((option) => {
+ const isActive = option.value === themePreference;
+ const Icon = option.icon;
+
+ return (
+ setThemePreference(option.value)}
+ >
+
+ );
+ })}
+
+
+
+ {isHosted ? (
+ <>
+
+
+
+
+ Analytics
+
+
+
+
Help improve OpenSEO
+
+ Share analytics and usage data.
+
+
+
{
+ void updateAnalyticsPreference(event.currentTarget.checked);
+ }}
+ aria-label="Enable product analytics"
+ />
+
+
+ ) : (
+
+ About
+
+ Version
+
+ v{version}
+
+
+
+ )}
+
+ );
+}
diff --git a/src/routes/_app/settings/organization.tsx b/src/routes/_app/settings/organization.tsx
new file mode 100644
index 0000000..ea7430a
--- /dev/null
+++ b/src/routes/_app/settings/organization.tsx
@@ -0,0 +1,14 @@
+import { createFileRoute, notFound } from "@tanstack/react-router";
+import { TeamSettings } from "@/client/features/team/TeamSettings";
+import { isHostedClientAuthMode } from "@/lib/auth-mode";
+
+export const Route = createFileRoute("/_app/settings/organization")({
+ // Self-host has no memberships or invitations — the better-auth HTTP
+ // surface isn't even mounted there.
+ beforeLoad: () => {
+ if (!isHostedClientAuthMode()) {
+ throw notFound();
+ }
+ },
+ component: TeamSettings,
+});
diff --git a/src/routes/_app/team.tsx b/src/routes/_app/team.tsx
new file mode 100644
index 0000000..3744074
--- /dev/null
+++ b/src/routes/_app/team.tsx
@@ -0,0 +1,9 @@
+import { createFileRoute, redirect } from "@tanstack/react-router";
+
+// The old standalone Team page moved into Settings → Organization; keep the
+// URL working for bookmarks.
+export const Route = createFileRoute("/_app/team")({
+ beforeLoad: () => {
+ throw redirect({ to: "/settings/organization" });
+ },
+});
diff --git a/src/routes/_authenticated.oauth-consent.tsx b/src/routes/_authenticated.oauth-consent.tsx
index 7b6e43b..35f7629 100644
--- a/src/routes/_authenticated.oauth-consent.tsx
+++ b/src/routes/_authenticated.oauth-consent.tsx
@@ -17,7 +17,7 @@ const SCOPES = [
{
icon: KeyRound,
label: "Act on your behalf via MCP",
- description: "Run tools and write results back to your workspace.",
+ description: "Run tools and write results back to your organization.",
},
];
diff --git a/src/routes/_authenticated.subscribe.tsx b/src/routes/_authenticated.subscribe.tsx
index d01f204..4f12197 100644
--- a/src/routes/_authenticated.subscribe.tsx
+++ b/src/routes/_authenticated.subscribe.tsx
@@ -10,6 +10,7 @@ import { getStandardErrorMessage } from "@/client/lib/error-messages";
import { getSubscribeRouteState } from "@/client/features/billing/route-state";
import { getCustomerPlanStatus } from "@/client/features/billing/plan-detection";
import { normalizeAuthRedirect } from "@/lib/auth-redirect";
+import { useCanManageBilling } from "@/client/features/team/organizationQueries";
import {
AUTUMN_MANAGED_ACCESS_FEATURE_ID,
AUTUMN_PAID_PLAN_ID,
@@ -59,6 +60,10 @@ function SubscribePage() {
},
});
+ // Checkout is owner-only; other members hitting the paywall are pointed at
+ // their organization owner instead of a Subscribe button that would 403.
+ const canManageBilling = useCanManageBilling();
+
// Read managed access from the already-loaded Autumn customer (local, no API
// call) instead of a separate server round-trip. Self-hosted has no Autumn
// customer, so mirror the server's "always granted" behavior there.
@@ -268,13 +273,20 @@ function SubscribePage() {
{error ?
{error}
: null}
-
void handleSubscribe()}
- >
- {isAttaching ? "Redirecting..." : "Subscribe"}
-
+ {canManageBilling ? (
+
void handleSubscribe()}
+ >
+ {isAttaching ? "Redirecting..." : "Subscribe"}
+
+ ) : (
+
+ Only the organization owner can subscribe. Ask them to upgrade this
+ organization.
+
+ )}
{
+ if (!isHostedClientAuthMode()) {
+ throw notFound();
+ }
+ },
+ component: AcceptInvitationPage,
+});
+
+function AcceptInvitationPage() {
+ const { id } = Route.useParams();
+ const { data: session, isPending: isSessionPending } = useSession();
+
+ return (
+
+ {isSessionPending ? null : session?.user ? (
+
+ );
+}
+
+// getInvitation requires a session matching the invited email, so a
+// logged-out visitor gets a generic shell — no invitation details are
+// exposed pre-auth by design.
+function SignedOutInvitationCard({ invitationId }: { invitationId: string }) {
+ const redirect = `/accept-invitation/${invitationId}`;
+
+ return (
+
+
+ You’ve been invited to join an organization on OpenSEO. Sign in
+ with the email address that received the invitation to accept it.
+
+
+
+
+ );
+}
+
+function InvitationCard({
+ invitationId,
+ userEmail,
+}: {
+ invitationId: string;
+ userEmail: string;
+}) {
+ const [isSubmitting, setIsSubmitting] = useState(false);
+ const [actionError, setActionError] = useState(null);
+ const [declined, setDeclined] = useState(false);
+
+ const invitationQuery = useQuery({
+ queryKey: ["invitation", invitationId],
+ queryFn: async () => {
+ const result = await authClient.organization.getInvitation({
+ query: { id: invitationId },
+ });
+ if (result.error) {
+ throw new Error(result.error.message || "Invitation not found");
+ }
+ return result.data;
+ },
+ retry: false,
+ });
+
+ async function handleAccept() {
+ setActionError(null);
+ setIsSubmitting(true);
+ try {
+ const accepted = await authClient.organization.acceptInvitation({
+ invitationId,
+ });
+ if (accepted.error) {
+ setActionError(
+ accepted.error.message || "We couldn't accept the invitation.",
+ );
+ setIsSubmitting(false);
+ return;
+ }
+
+ // Accepting updates the session row but not the session cookie cache;
+ // setActive refreshes the cookie so the app opens in the joined org
+ // immediately instead of after the cache expires.
+ await authClient.organization.setActive({
+ organizationId: accepted.data.invitation.organizationId,
+ });
+ captureClientEvent("team:invitation_accept");
+ // Full navigation: every cached query in this tab belongs to the old
+ // workspace.
+ window.location.assign("/");
+ } catch {
+ setActionError("We couldn't accept the invitation. Please try again.");
+ setIsSubmitting(false);
+ }
+ }
+
+ async function handleDecline() {
+ setActionError(null);
+ setIsSubmitting(true);
+ try {
+ const result = await authClient.organization.rejectInvitation({
+ invitationId,
+ });
+ if (result.error) {
+ setActionError(
+ result.error.message || "We couldn't decline the invitation.",
+ );
+ setIsSubmitting(false);
+ return;
+ }
+ captureClientEvent("team:invitation_decline");
+ setDeclined(true);
+ } catch {
+ setActionError("We couldn't decline the invitation. Please try again.");
+ setIsSubmitting(false);
+ }
+ }
+
+ if (invitationQuery.isPending) {
+ return (
+
+
+
+
+ );
+ }
+
+ if (invitationQuery.isError) {
+ return (
+
+
+ This invitation may have expired, been canceled, or belong to a
+ different email address. You’re signed in as{" "}
+
+ {userEmail}
+
+ .
+
+
+ If the invitation was sent to another address, sign out and sign back
+ in with that email. Otherwise ask your teammate to send a new invite.
+
+
+ {
+ // Signs out, then lands on sign-in with a redirect back to this
+ // invitation (staying signed in would bounce straight back here).
+ signOutAndRedirect();
+ }}
+ >
+ Use a different account
+
+
+
+ );
+ }
+
+ if (declined) {
+ return (
+
+
+ You declined the invitation to join{" "}
+
+ {invitationQuery.data.organizationName}
+
+ .
+
+
+ );
+ }
+
+ return (
+
+
+
+ {invitationQuery.data.inviterEmail}
+ {" "}
+ invited you to join{" "}
+
+ {invitationQuery.data.organizationName}
+ {" "}
+ on OpenSEO.
+
+ {actionError ? {actionError}
: null}
+
+ void handleAccept()}
+ >
+ {isSubmitting ? "Joining..." : "Accept invitation"}
+
+ void handleDecline()}
+ >
+ Decline
+
+
+
+ );
+}
diff --git a/src/routes/api/autumn/$.ts b/src/routes/api/autumn/$.ts
index 47aaaff..ebb58b5 100644
--- a/src/routes/api/autumn/$.ts
+++ b/src/routes/api/autumn/$.ts
@@ -2,7 +2,29 @@ import { createFileRoute } from "@tanstack/react-router";
import type { autumnHandler } from "autumn-js/fetch";
import { env } from "cloudflare:workers";
import { isHostedAuthMode } from "@/lib/auth-mode";
+import { hasOrgPermission } from "@/lib/org-permissions";
import { resolveHostedContext } from "@/middleware/ensure-user/hosted";
+import type { EnsuredUserContext } from "@/middleware/ensure-user/types";
+
+// Autumn routes any org member may call: balance/customer reads that power
+// credit meters and usage views. Every other route (attach, updateSubscription,
+// openCustomerPortal, setupPayment, referrals, previews, ...) changes the
+// org's subscription or payment state and is owner-only — unknown/new routes
+// fail closed into the owner-only branch.
+const MEMBER_READABLE_AUTUMN_ROUTES = new Set([
+ "getOrCreateCustomer",
+ "getEntity",
+ "listPlans",
+ "listEvents",
+ "aggregateEvents",
+]);
+
+// The caller's context is resolved exactly once per request, in
+// handleAutumnRequest, and shared with Autumn's identify callback through this
+// map. Resolving twice (identify re-reads the same headers) would let an
+// active-org switch or membership change between the two reads authorize
+// against one organization but bill another.
+const contextByRequest = new WeakMap();
let handlerPromise: Promise> | undefined;
@@ -13,7 +35,14 @@ function loadHandler() {
({ autumnHandler }) =>
autumnHandler({
identify: async (request) => {
- const context = await resolveHostedContext(request.headers);
+ const context = contextByRequest.get(request);
+ // identify is only reachable via handleAutumnRequest, which resolves
+ // first — fail closed rather than re-resolving if that ever breaks.
+ if (!context) {
+ throw new Error(
+ "Autumn identify called without a resolved context",
+ );
+ }
return {
customerId: context.organizationId,
@@ -30,6 +59,31 @@ async function handleAutumnRequest(request: Request) {
});
}
+ let context;
+ try {
+ context = await resolveHostedContext(request.headers);
+ } catch {
+ return Response.json(
+ { message: "Authentication required.", code: "unauthenticated" },
+ { status: 401 },
+ );
+ }
+ contextByRequest.set(request, context);
+
+ const route = new URL(request.url).pathname.split("/").pop() ?? "";
+ if (
+ !MEMBER_READABLE_AUTUMN_ROUTES.has(route) &&
+ !hasOrgPermission(context.role, { billing: ["manage"] })
+ ) {
+ return Response.json(
+ {
+ message: "Only the organization owner can manage billing.",
+ code: "billing_owner_required",
+ },
+ { status: 403 },
+ );
+ }
+
return (await loadHandler())(request);
}
diff --git a/src/server/auth/default-hosted-organization.test.ts b/src/server/auth/default-hosted-organization.test.ts
new file mode 100644
index 0000000..39a3ad3
--- /dev/null
+++ b/src/server/auth/default-hosted-organization.test.ts
@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { resolveSignInHostedOrganization } from "@/server/auth/default-hosted-organization";
+
+const mocks = vi.hoisted(() => ({
+ getLastActiveOrganizationId: vi.fn(),
+ getMembership: vi.fn(),
+ findNewestMembershipForUser: vi.fn(),
+ findFirstOrganizationIdForUser: vi.fn(),
+ getHostedUser: vi.fn(),
+ hasPendingInvitationForEmail: vi.fn(),
+}));
+
+vi.mock("@/server/auth/repositories/AuthRepository", () => ({
+ AuthRepository: mocks,
+}));
+
+// Referral pin repair is fire-and-forget KV bookkeeping; mocking it keeps
+// `cloudflare:workers` out of this module graph.
+vi.mock("@/server/referrals/dub", () => ({
+ markDubReferredOrganization: vi.fn(),
+}));
+
+describe("resolveSignInHostedOrganization", () => {
+ beforeEach(() => {
+ mocks.getLastActiveOrganizationId.mockResolvedValue(null);
+ mocks.findNewestMembershipForUser.mockResolvedValue(null);
+ mocks.getHostedUser.mockResolvedValue({
+ id: "user-1",
+ email: "invitee@example.com",
+ name: "Invitee",
+ });
+ mocks.getMembership.mockResolvedValue({ role: "owner" });
+ });
+
+ // The invite-signup invariant: a brand-new user with a pending invitation
+ // must NOT get a personal organization auto-minted at sign-in — accepting the
+ // invite should leave them in exactly the inviter's org.
+ it("defers organization creation while an invitation is pending", async () => {
+ mocks.hasPendingInvitationForEmail.mockResolvedValue(true);
+ const createOrganization = vi.fn();
+
+ await expect(
+ resolveSignInHostedOrganization("user-1", createOrganization),
+ ).resolves.toBeNull();
+
+ expect(createOrganization).not.toHaveBeenCalled();
+ });
+
+ it("creates the default organization when no invitation is pending", async () => {
+ mocks.hasPendingInvitationForEmail.mockResolvedValue(false);
+ const createOrganization = vi.fn().mockResolvedValue({ id: "org-new" });
+
+ await expect(
+ resolveSignInHostedOrganization("user-1", createOrganization),
+ ).resolves.toMatchObject({ organizationId: "org-new" });
+ });
+
+ // An existing membership always wins — the pending-invite check only
+ // applies to membership-less users, so inviting an existing user never
+ // hides their current organization.
+ it("returns the existing membership without checking invitations", async () => {
+ mocks.findNewestMembershipForUser.mockResolvedValue({
+ organizationId: "org-existing",
+ role: "admin",
+ });
+
+ await expect(
+ resolveSignInHostedOrganization("user-1", vi.fn()),
+ ).resolves.toEqual({ organizationId: "org-existing", role: "admin" });
+
+ expect(mocks.hasPendingInvitationForEmail).not.toHaveBeenCalled();
+ });
+});
diff --git a/src/server/auth/default-hosted-organization.ts b/src/server/auth/default-hosted-organization.ts
index 0b8a247..c24e794 100644
--- a/src/server/auth/default-hosted-organization.ts
+++ b/src/server/auth/default-hosted-organization.ts
@@ -20,12 +20,12 @@ type HostedOrganizationCreator = (
function getDefaultHostedOrganizationName(user: HostedUser) {
const name = user.name?.trim() || user.email.split("@")[0] || "OpenSEO";
- return `${name}'s workspace`;
+ return `${name}'s organization`;
}
function getDefaultHostedOrganizationSlug(user: HostedUser) {
const slugSource =
- user.name?.trim() || user.email.split("@")[0] || "workspace";
+ user.name?.trim() || user.email.split("@")[0] || "organization";
const suffix = toHex(user.id).slice(0, 12);
return `${slugify(slugSource)}-${suffix}`;
}
@@ -65,27 +65,133 @@ async function createDefaultHostedOrganization(
}
}
-export async function getOrCreateDefaultHostedOrganization(
- userId: string,
- createOrganization: HostedOrganizationCreator,
-) {
- let organizationId =
- await AuthRepository.findFirstOrganizationIdForUser(userId);
+type ActiveHostedOrganization = {
+ organizationId: string;
+ role: string;
+};
- if (!organizationId) {
- const hostedUser = await getHostedUser(userId);
- organizationId = await createDefaultHostedOrganization(
- hostedUser,
- createOrganization,
+async function findExistingActiveOrganization(
+ userId: string,
+): Promise {
+ const lastActiveOrganizationId =
+ await AuthRepository.getLastActiveOrganizationId(userId);
+
+ if (lastActiveOrganizationId) {
+ const membership = await AuthRepository.getMembership(
+ userId,
+ lastActiveOrganizationId,
);
+
+ if (membership) {
+ return {
+ organizationId: lastActiveOrganizationId,
+ role: membership.role,
+ };
+ }
}
- // On every session, not just org creation: the signup-time referral pin can
- // land after the org exists (email verification from another location, or
- // BYPASS_EMAIL_VERIFICATION creating the session inside the signup
- // transaction before user.create.after hooks flush), so later logins repair
- // the org pin. No-ops without a user pin.
- await markDubReferredOrganization(userId);
+ const newestMembership =
+ await AuthRepository.findNewestMembershipForUser(userId);
- return organizationId;
+ if (newestMembership) {
+ return {
+ organizationId: newestMembership.organizationId,
+ role: newestMembership.role,
+ };
+ }
+
+ return null;
+}
+
+async function createActiveHostedOrganization(
+ userId: string,
+ createOrganization: HostedOrganizationCreator,
+): Promise {
+ const hostedUser = await getHostedUser(userId);
+ const organizationId = await createDefaultHostedOrganization(
+ hostedUser,
+ createOrganization,
+ );
+
+ // Read the role instead of asserting "owner": a create that lost a race
+ // falls back to whatever membership won, which may not be owner-created.
+ const membership = await AuthRepository.getMembership(userId, organizationId);
+ return { organizationId, role: membership?.role ?? "owner" };
+}
+
+// On every resolution, not just org creation: the signup-time referral pin
+// can land after the org exists (email verification from another location,
+// or BYPASS_EMAIL_VERIFICATION creating the session inside the signup
+// transaction before user.create.after hooks flush), so later logins repair
+// the org pin. No-ops without a user pin, and only ever pins an org the user
+// founded — an invitee's membership never counts.
+async function repairDubReferralPin(userId: string) {
+ await markDubReferredOrganization(userId);
+}
+
+// Picks the org a hosted user should be working in: their last-active org if
+// they still belong to it, else their most recently joined org (so a fresh
+// invite acceptance beats the signup-minted personal organization), else a
+// newly created default organization. Used by the stale-session fallback in
+// resolveHostedContext.
+export async function resolveActiveHostedOrganization(
+ userId: string,
+ createOrganization: HostedOrganizationCreator,
+): Promise {
+ const existing = await findExistingActiveOrganization(userId);
+ if (existing) {
+ await repairDubReferralPin(userId);
+ return existing;
+ }
+ const created = await createActiveHostedOrganization(
+ userId,
+ createOrganization,
+ );
+ await repairDubReferralPin(userId);
+ return created;
+}
+
+// Same as resolveActiveHostedOrganization, but never mints a default
+// organization. Used by API-key authentication: a user with no memberships has
+// no org to bill or authorize, so credentials should be rejected instead of
+// silently spinning up a new workspace.
+export async function resolveExistingActiveHostedOrganization(
+ userId: string,
+): Promise {
+ const existing = await findExistingActiveOrganization(userId);
+ if (!existing) {
+ return null;
+ }
+ await repairDubReferralPin(userId);
+ return existing;
+}
+
+// Sign-in (session-create hook) variant: same resolution, except a user with
+// no memberships and a pending invitation gets NO auto-minted personal
+// organization — someone who signs up from an invite link should end up in
+// exactly the inviter's org, not that plus an empty personal one. Returns
+// null in that window (the session carries no active org until they accept).
+// Abandoning the invite flow self-heals: the next app request goes through
+// resolveActiveHostedOrganization, which still creates a default organization.
+export async function resolveSignInHostedOrganization(
+ userId: string,
+ createOrganization: HostedOrganizationCreator,
+): Promise {
+ const existing = await findExistingActiveOrganization(userId);
+ if (existing) {
+ await repairDubReferralPin(userId);
+ return existing;
+ }
+
+ const hostedUser = await getHostedUser(userId);
+ if (await AuthRepository.hasPendingInvitationForEmail(hostedUser.email)) {
+ return null;
+ }
+
+ const created = await createActiveHostedOrganization(
+ userId,
+ createOrganization,
+ );
+ await repairDubReferralPin(userId);
+ return created;
}
diff --git a/src/server/auth/delegated-organization.ts b/src/server/auth/delegated-organization.ts
index 2077a27..2fa024d 100644
--- a/src/server/auth/delegated-organization.ts
+++ b/src/server/auth/delegated-organization.ts
@@ -9,7 +9,7 @@ export const SHARED_WORKSPACE_ORGANIZATION_ID = "shared-workspace";
export async function ensureSharedWorkspaceOrganization() {
await AuthRepository.upsertDelegatedOrganization({
id: SHARED_WORKSPACE_ORGANIZATION_ID,
- name: "Shared workspace",
+ name: "Shared organization",
slug: SHARED_WORKSPACE_ORGANIZATION_ID,
});
@@ -21,7 +21,7 @@ function getDelegatedOrganizationId(userId: string) {
}
function getDelegatedOrganizationName(email: string, userId: string) {
- return `${email.split("@")[0] || userId} workspace`;
+ return `${email.split("@")[0] || userId} organization`;
}
function getDelegatedOrganizationSlug(email: string, userId: string) {
diff --git a/src/server/auth/invitation-send-limit.ts b/src/server/auth/invitation-send-limit.ts
new file mode 100644
index 0000000..04f54c8
--- /dev/null
+++ b/src/server/auth/invitation-send-limit.ts
@@ -0,0 +1,52 @@
+import { env } from "cloudflare:workers";
+import { AppError } from "@/server/lib/errors";
+
+// Daily caps on invitation *emails*. The org plugin's invitationLimit bounds
+// pending rows (20), but re-sends to an already-invited address are unbounded
+// there — this is the bound on actual sends. KV is the only counter that
+// holds across Workers isolates; the fixed UTC-day window keys expire on
+// their own. KV writes race under concurrency, so treat these as abuse
+// bounds, not exact quotas.
+const PER_ADDRESS_DAILY_LIMIT = 5;
+const PER_ORG_DAILY_LIMIT = 50;
+const WINDOW_TTL_SECONDS = 60 * 60 * 24;
+
+async function bumpDailyCounter(key: string, limit: number) {
+ const count = Number((await env.KV.get(key)) ?? "0");
+ if (count >= limit) return false;
+ await env.KV.put(key, String(count + 1), {
+ expirationTtl: WINDOW_TTL_SECONDS,
+ });
+ return true;
+}
+
+export async function consumeInvitationSendBudget(
+ organizationId: string,
+ email: string,
+) {
+ const day = new Date().toISOString().slice(0, 10);
+ const address = email.trim().toLowerCase();
+
+ if (
+ !(await bumpDailyCounter(
+ `invite-sends:${organizationId}:${day}`,
+ PER_ORG_DAILY_LIMIT,
+ ))
+ ) {
+ throw new AppError(
+ "RATE_LIMITED",
+ "This organization has reached its daily invitation limit.",
+ );
+ }
+ if (
+ !(await bumpDailyCounter(
+ `invite-sends:${organizationId}:${address}:${day}`,
+ PER_ADDRESS_DAILY_LIMIT,
+ ))
+ ) {
+ throw new AppError(
+ "RATE_LIMITED",
+ "This address has already received several invitations today.",
+ );
+ }
+}
diff --git a/src/server/auth/invited-member.ts b/src/server/auth/invited-member.ts
new file mode 100644
index 0000000..7f0a203
--- /dev/null
+++ b/src/server/auth/invited-member.ts
@@ -0,0 +1,37 @@
+import { db } from "@/db";
+import { userOnboardingAnswers } from "@/db/schema";
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
+
+// Runs after an invitation is accepted: point the user's next sign-in at the
+// org they just joined, and skip first-run onboarding — the wizard configures
+// the org's project (domain, market) and spends org credits, which must not be
+// re-run against an already-configured workspace.
+export async function onInvitationAccepted(input: {
+ userId: string;
+ organizationId: string;
+}) {
+ const now = new Date().toISOString();
+
+ await AuthRepository.setLastActiveOrganization(
+ input.userId,
+ input.organizationId,
+ );
+
+ await db
+ .insert(userOnboardingAnswers)
+ .values({
+ userId: input.userId,
+ organizationId: input.organizationId,
+ completedAt: now,
+ gscNudgeDismissedAt: now,
+ updatedAt: now,
+ })
+ .onConflictDoUpdate({
+ target: userOnboardingAnswers.userId,
+ set: {
+ completedAt: now,
+ gscNudgeDismissedAt: now,
+ updatedAt: now,
+ },
+ });
+}
diff --git a/src/server/auth/org-gate.ts b/src/server/auth/org-gate.ts
new file mode 100644
index 0000000..e1d25fa
--- /dev/null
+++ b/src/server/auth/org-gate.ts
@@ -0,0 +1,20 @@
+import {
+ hasOrgPermission,
+ type OrgPermissionRequest,
+} from "@/lib/org-permissions";
+import type { EnsuredUserContext } from "@/middleware/ensure-user/types";
+import { AppError } from "@/server/lib/errors";
+
+// Server-side org-role gate for app resources (billing/project/integration).
+// Zero-I/O: the role was already resolved from the member row by ensure-user.
+export function requireOrgPermission(
+ context: Pick,
+ permissions: OrgPermissionRequest,
+) {
+ if (!hasOrgPermission(context.role, permissions)) {
+ throw new AppError(
+ "FORBIDDEN",
+ "Your organization role does not allow this action.",
+ );
+ }
+}
diff --git a/src/server/auth/org-slug.ts b/src/server/auth/org-slug.ts
index ede1ff5..74e05b6 100644
--- a/src/server/auth/org-slug.ts
+++ b/src/server/auth/org-slug.ts
@@ -6,7 +6,7 @@ export function slugify(value: string) {
.replace(/^-+|-+$/g, "")
.slice(0, 48);
- return slug || "workspace";
+ return slug || "organization";
}
export function toHex(value: string) {
diff --git a/src/server/auth/repositories/AuthRepository.ts b/src/server/auth/repositories/AuthRepository.ts
index ff90098..64292f2 100644
--- a/src/server/auth/repositories/AuthRepository.ts
+++ b/src/server/auth/repositories/AuthRepository.ts
@@ -1,6 +1,21 @@
-import { aliasedTable, and, asc, eq, lt, notExists } from "drizzle-orm";
+import {
+ aliasedTable,
+ and,
+ asc,
+ desc,
+ eq,
+ gt,
+ lt,
+ notExists,
+ sql,
+} from "drizzle-orm";
import { db } from "@/db";
-import { member, organization, user as authUser } from "@/db/schema";
+import {
+ invitation,
+ member,
+ organization,
+ user as authUser,
+} from "@/db/schema";
type DelegatedOrganizationInput = {
id: string;
@@ -80,9 +95,94 @@ async function getHostedUser(userId: string) {
});
}
+// The per-request membership check: session.activeOrganizationId is only an
+// identity hint, this row is the authorization fact. Returns null when the
+// user is not (or no longer) a member.
+async function getMembership(userId: string, organizationId: string) {
+ const [membership] = await db
+ .select({ role: member.role })
+ .from(member)
+ .where(
+ and(eq(member.userId, userId), eq(member.organizationId, organizationId)),
+ )
+ .limit(1);
+
+ return membership ?? null;
+}
+
+// Fallback active-org choice when there is no valid last-active pointer: the
+// most recently joined org, so a just-accepted invitation wins over the
+// signup-minted personal workspace.
+async function findNewestMembershipForUser(userId: string) {
+ const [membership] = await db
+ .select({ organizationId: member.organizationId, role: member.role })
+ .from(member)
+ .where(eq(member.userId, userId))
+ .orderBy(desc(member.createdAt))
+ .limit(1);
+
+ return membership ?? null;
+}
+
+async function listMembershipsForUser(userId: string) {
+ return db
+ .select({
+ organizationId: member.organizationId,
+ organizationName: organization.name,
+ role: member.role,
+ })
+ .from(member)
+ .innerJoin(organization, eq(member.organizationId, organization.id))
+ .where(eq(member.userId, userId))
+ .orderBy(asc(member.createdAt));
+}
+
+// Case-insensitive on purpose: better-auth lowercases the address when it
+// mails an invite, but the stored row keeps whatever the inviter typed.
+async function hasPendingInvitationForEmail(email: string) {
+ const [pending] = await db
+ .select({ id: invitation.id })
+ .from(invitation)
+ .where(
+ and(
+ eq(sql`lower(${invitation.email})`, email.trim().toLowerCase()),
+ eq(invitation.status, "pending"),
+ gt(invitation.expiresAt, new Date()),
+ ),
+ )
+ .limit(1);
+
+ return pending !== undefined;
+}
+
+async function getLastActiveOrganizationId(userId: string) {
+ const record = await db.query.user.findFirst({
+ columns: { lastActiveOrganizationId: true },
+ where: eq(authUser.id, userId),
+ });
+
+ return record?.lastActiveOrganizationId ?? null;
+}
+
+async function setLastActiveOrganization(
+ userId: string,
+ organizationId: string,
+) {
+ await db
+ .update(authUser)
+ .set({ lastActiveOrganizationId: organizationId })
+ .where(eq(authUser.id, userId));
+}
+
export const AuthRepository = {
upsertDelegatedOrganization,
findFirstOrganizationIdForUser,
findFirstFoundedOrganizationIdForUser,
+ findNewestMembershipForUser,
+ getMembership,
+ listMembershipsForUser,
+ getLastActiveOrganizationId,
+ setLastActiveOrganization,
getHostedUser,
+ hasPendingInvitationForEmail,
} as const;
diff --git a/src/server/email/loops.ts b/src/server/email/loops.ts
index cea0074..39afaa2 100644
--- a/src/server/email/loops.ts
+++ b/src/server/email/loops.ts
@@ -128,6 +128,37 @@ export async function sendHostedVerificationEmail({
});
}
+export async function sendHostedInvitationEmail({
+ email,
+ inviteUrl,
+ organizationName,
+ inviterName,
+ inviterEmail,
+}: {
+ email: string;
+ inviteUrl: string;
+ organizationName: string;
+ inviterName: string;
+ inviterEmail: string;
+}) {
+ // Not part of getHostedAuthEmailConfig(): that trio gates hasHostedAuthConfig
+ // and adding a new required var there would brick existing deployments.
+ const apiKey = getRequiredEnv("LOOPS_API_KEY");
+ const templateId = getRequiredEnv("LOOPS_TRANSACTIONAL_INVITATION_ID");
+ await sendLoopsTransactionalEmail({
+ apiKey,
+ email,
+ transactionalId: templateId,
+ dataVariables: {
+ appName: "OpenSEO",
+ inviteUrl,
+ organizationName,
+ inviterName,
+ inviterEmail,
+ },
+ });
+}
+
export async function sendHostedPasswordResetEmail({
email,
resetUrl,
diff --git a/src/server/features/audit/repositories/AuditRepository.ts b/src/server/features/audit/repositories/AuditRepository.ts
index 3dd1542..8c90118 100644
--- a/src/server/features/audit/repositories/AuditRepository.ts
+++ b/src/server/features/audit/repositories/AuditRepository.ts
@@ -11,6 +11,7 @@ import {
auditIssues,
auditLighthouseResults,
auditPages,
+ projects,
} from "@/db/schema";
import { executeInBatches } from "@/db/runBatch";
import { AUDIT_ISSUE_TYPES } from "@/shared/audit-issues";
@@ -340,15 +341,19 @@ async function getAuditsByProject(projectId: string) {
return rows.map(({ audit }) => audit);
}
-async function getAuditUsageForUser(userId: string) {
- const rows = await db.query.audits.findMany({
- where: eq(audits.startedByUserId, userId),
- columns: {
- status: true,
- pagesTotal: true,
- lighthouseTotal: true,
- },
- });
+// Org-scoped: the free-plan quota belongs to the org (the Autumn customer),
+// so usage must aggregate across every member — counting per starting user
+// would multiply the free ceiling by the member count.
+async function getAuditUsageForOrganization(organizationId: string) {
+ const rows = await db
+ .select({
+ status: audits.status,
+ pagesTotal: audits.pagesTotal,
+ lighthouseTotal: audits.lighthouseTotal,
+ })
+ .from(audits)
+ .innerJoin(projects, eq(audits.projectId, projects.id))
+ .where(eq(projects.organizationId, organizationId));
return {
capacityUnits: rows.reduce(
@@ -437,7 +442,7 @@ export const AuditRepository = {
countBlockedPages,
hasPagesForAudit,
getAuditsByProject,
- getAuditUsageForUser,
+ getAuditUsageForOrganization,
getAuditResultsForProject,
getLighthouseResultById,
deleteAuditForProject,
diff --git a/src/server/features/audit/services/AuditService.ts b/src/server/features/audit/services/AuditService.ts
index f47d98f..ef9de85 100644
--- a/src/server/features/audit/services/AuditService.ts
+++ b/src/server/features/audit/services/AuditService.ts
@@ -94,8 +94,11 @@ async function startAudit(input: {
// pass the free tier's running-audits gate. Post-insert, each request sees
// at least its own row, so racers can't all slip under the limit; the
// losers roll back via the catch below. Racers at the boundary may all
- // abort — the user just retries.
- const usage = await AuditRepository.getAuditUsageForUser(input.actorUserId);
+ // abort — the user just retries. Usage counts per ORGANIZATION, not per
+ // user: the free ceiling is the org's, so N members don't multiply it.
+ const usage = await AuditRepository.getAuditUsageForOrganization(
+ input.billingCustomer.organizationId,
+ );
if (usage.runningCount > limits.maxRunningAudits) {
throw new AppError("AUDIT_ALREADY_RUNNING");
}
diff --git a/src/server/features/projects/services/ProjectService.ts b/src/server/features/projects/services/ProjectService.ts
index e34f44f..2861999 100644
--- a/src/server/features/projects/services/ProjectService.ts
+++ b/src/server/features/projects/services/ProjectService.ts
@@ -2,6 +2,7 @@ import {
archiveProject,
createProject,
getProjectForOrganization,
+ getProjectWithOrganization,
listArchivedProjects,
listProjects,
listProjectsEnsuringOne,
@@ -22,4 +23,5 @@ export const ProjectService = {
restoreProject,
listArchivedProjects,
getProjectForOrganization,
+ getProjectWithOrganization,
} as const;
diff --git a/src/server/features/projects/services/projects.ts b/src/server/features/projects/services/projects.ts
index 27d0209..1c272bb 100644
--- a/src/server/features/projects/services/projects.ts
+++ b/src/server/features/projects/services/projects.ts
@@ -244,3 +244,15 @@ export async function getProjectForOrganization(
return mapProject(project);
}
+
+// Project lookup that reveals which org owns it, for user-scoped credentials
+// (MCP API keys): the caller derives the org FROM the project and must then
+// authorize the user's membership in that org before acting on the result.
+export async function getProjectWithOrganization(projectId: string) {
+ const project = await ProjectRepository.getProjectById(projectId);
+ if (!project) return null;
+ return {
+ organizationId: project.organizationId,
+ project: mapProject(project),
+ };
+}
diff --git a/src/server/features/sam/SamChatAgent.ts b/src/server/features/sam/SamChatAgent.ts
index beb9f72..8d72ef9 100644
--- a/src/server/features/sam/SamChatAgent.ts
+++ b/src/server/features/sam/SamChatAgent.ts
@@ -36,6 +36,7 @@ import {
import { captureServerEvent } from "@/server/lib/posthog";
import { getPublicOrigin } from "@/server/mcp/public-origin";
import { MCP_SCOPE } from "@/lib/oauth-resource";
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
import type { ToolAuthContext } from "@/server/mcp/context";
// SAM's read-only view of the project's shared memory. The block has no `set`
@@ -267,7 +268,8 @@ export class SamChatAgent extends Think {
// confirmed against a second Autumn read path before refusing — a
// stale check reading here once locked a paying customer out of chat.
const { organizationId } = ctx.project;
- if (await isHostedServerAuthMode()) {
+ const hosted = await isHostedServerAuthMode();
+ if (hosted) {
const { depleted, monthlyRemaining } = await checkUsageCreditsDepleted({
userId: ctx.row.userId,
userEmail: ctx.userEmail,
@@ -285,10 +287,28 @@ export class SamChatAgent extends Think {
const baseUrl =
(await this.ctx.storage.get(PUBLIC_ORIGIN_KEY)) ??
"https://app.openseo.so";
+ // Delegated/self-host orgs have no member rows — implicit owner. In
+ // hosted mode a missing member row means the user was removed from the
+ // workspace; fail closed instead of letting the open socket keep
+ // owner-level tools (WebSockets authorize at connect time only, so this
+ // per-turn check is what actually revokes a removed member's chat).
+ const membership = await AuthRepository.getMembership(
+ ctx.row.userId,
+ organizationId,
+ );
+ if (hosted && !membership) {
+ return this.refusalTurn(
+ "You no longer have access to this organization, so I can't continue this chat.",
+ );
+ }
const authContext: ToolAuthContext = {
userId: ctx.row.userId,
userEmail: ctx.userEmail,
organizationId,
+ role: membership?.role ?? "owner",
+ // SAM sessions belong to one project's workspace; org context is
+ // fixed for the session, like an OAuth token's.
+ orgScope: "pinned",
baseUrl,
clientId: null,
scopes: [MCP_SCOPE],
diff --git a/src/server/mcp/api-key-auth.test.ts b/src/server/mcp/api-key-auth.test.ts
index 872772e..fb74874 100644
--- a/src/server/mcp/api-key-auth.test.ts
+++ b/src/server/mcp/api-key-auth.test.ts
@@ -6,7 +6,7 @@ import type { handleAuthenticatedOpenSeoMcpRequest } from "@/server/mcp/transpor
const mocks = vi.hoisted(() => ({
verifyApiKey: vi.fn(),
getHostedUser: vi.fn(),
- getOrCreateDefaultHostedOrganization: vi.fn(),
+ resolveExistingActiveHostedOrganization: vi.fn(),
recordMcpAuthorized: vi.fn(),
handleAuthenticatedOpenSeoMcpRequest:
vi.fn(),
@@ -29,8 +29,8 @@ vi.mock("@/server/auth/repositories/AuthRepository", () => ({
}));
vi.mock("@/server/auth/default-hosted-organization", () => ({
- getOrCreateDefaultHostedOrganization:
- mocks.getOrCreateDefaultHostedOrganization,
+ resolveExistingActiveHostedOrganization:
+ mocks.resolveExistingActiveHostedOrganization,
}));
vi.mock("@/server/features/activation/mcpActivation", () => ({
@@ -63,7 +63,10 @@ describe("handleMcpApiKeyRequest", () => {
email: "person@example.com",
name: "Person",
});
- mocks.getOrCreateDefaultHostedOrganization.mockResolvedValue("org-1");
+ mocks.resolveExistingActiveHostedOrganization.mockResolvedValue({
+ organizationId: "org-1",
+ role: "owner",
+ });
mocks.recordMcpAuthorized.mockResolvedValue(undefined);
mocks.handleAuthenticatedOpenSeoMcpRequest.mockResolvedValue(
new Response("mcp response"),
@@ -84,9 +87,8 @@ describe("handleMcpApiKeyRequest", () => {
expect(mocks.verifyApiKey).toHaveBeenCalledWith({
body: { key: "oseo_secret" },
});
- expect(mocks.getOrCreateDefaultHostedOrganization).toHaveBeenCalledWith(
+ expect(mocks.resolveExistingActiveHostedOrganization).toHaveBeenCalledWith(
"user-1",
- expect.any(Function),
);
expect(mocks.recordMcpAuthorized).toHaveBeenCalledWith("org-1");
expect(mocks.handleAuthenticatedOpenSeoMcpRequest).toHaveBeenCalledTimes(1);
@@ -100,6 +102,10 @@ describe("handleMcpApiKeyRequest", () => {
userId: "user-1",
userEmail: "person@example.com",
organizationId: "org-1",
+ role: "owner",
+ // The key is user-scoped: project tools authorize per call via
+ // membership in the project's org, not this request-level org.
+ orgScope: "user",
scopes: [...MCP_OAUTH_SCOPES],
clientId: "api_key",
baseUrl: "https://app.openseo.so",
@@ -125,6 +131,27 @@ describe("handleMcpApiKeyRequest", () => {
});
});
+ it("returns 403 when the user has no organization membership", async () => {
+ mocks.verifyApiKey.mockResolvedValue({
+ valid: true,
+ error: null,
+ key: { referenceId: "user-1" },
+ });
+ mocks.resolveExistingActiveHostedOrganization.mockResolvedValue(null);
+
+ const response = await handleMcpApiKeyRequest(
+ request({ Authorization: "Bearer oseo_secret" }),
+ env,
+ ctx,
+ );
+
+ expect(response?.status).toBe(403);
+ await expect(response?.json()).resolves.toMatchObject({
+ error: "account_access_revoked",
+ });
+ expect(mocks.handleAuthenticatedOpenSeoMcpRequest).not.toHaveBeenCalled();
+ });
+
it("returns 401 for an invalid key without invoking the transport", async () => {
mocks.verifyApiKey.mockResolvedValue({
valid: false,
diff --git a/src/server/mcp/api-key-auth.ts b/src/server/mcp/api-key-auth.ts
index 31cd333..171e1c1 100644
--- a/src/server/mcp/api-key-auth.ts
+++ b/src/server/mcp/api-key-auth.ts
@@ -1,7 +1,7 @@
import { getAuth, getHostedBaseUrl } from "@/lib/auth";
import { API_KEY_PREFIX } from "@/lib/auth-api-key";
import { MCP_OAUTH_SCOPES } from "@/lib/oauth-resource";
-import { getOrCreateDefaultHostedOrganization } from "@/server/auth/default-hosted-organization";
+import { resolveExistingActiveHostedOrganization } from "@/server/auth/default-hosted-organization";
import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
import { recordMcpAuthorized } from "@/server/features/activation/mcpActivation";
import { createWorkersOAuthMcpProps, MCP_ROUTE } from "@/server/mcp/context";
@@ -29,6 +29,7 @@ function apiKeyErrorResponse(
const isLimited =
error?.code === "RATE_LIMITED" || error?.code === "USAGE_EXCEEDED";
+ const isForbidden = error?.code === "FORBIDDEN";
if (isLimited) {
// The plugin reports tryAgainIn (milliseconds) for RATE_LIMITED, but its
// published error type omits `details`, so narrow at runtime.
@@ -49,13 +50,19 @@ function apiKeyErrorResponse(
? error?.code === "RATE_LIMITED"
? "rate_limited"
: "usage_exceeded"
- : "invalid_api_key";
+ : isForbidden
+ ? "account_access_revoked"
+ : "invalid_api_key";
const description = isLimited
? typeof error?.message === "string"
? error.message
: "API key request limit reached"
- : "The provided API key is invalid, expired, or disabled";
- const status = isLimited ? 429 : 401;
+ : isForbidden
+ ? typeof error?.message === "string"
+ ? error.message
+ : "This API key is no longer associated with an organization"
+ : "The provided API key is invalid, expired, or disabled";
+ const status = isLimited ? 429 : isForbidden ? 403 : 401;
// Bad credentials are client-side noise, so 401 logs at debug (mirroring the
// OAuth path); a 429 means we actually cut a caller off, so warn.
@@ -103,7 +110,7 @@ export async function handleMcpApiKeyRequest(
// clients (see lib/auth-api-key.ts). Cloudflare's counter is per-colo
// best-effort, which is all this needs to be: credits bound spend, this
// bounds runaway request volume.
- // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- the binding is declared in alchemy.run.ts; env stays unknown through the MCP handler chain
+ // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- the binding is declared as a rate limiter in alchemy.run.ts; absent outside hosted prod
const rateLimit = (env as { MCP_RATE_LIMIT?: RateLimit }).MCP_RATE_LIMIT;
if (rateLimit) {
const { success } = await rateLimit.limit({ key: userId });
@@ -119,22 +126,31 @@ export async function handleMcpApiKeyRequest(
const user = await AuthRepository.getHostedUser(userId);
if (!user?.email) return apiKeyErrorResponse(null);
- // API keys bill the user's default hosted workspace (their first org).
- // The hosted product provisions exactly one org per user. Decided
- // direction for multi-org: keys stay user-scoped and the org derives from
- // the project each tool call names (project-level authz) — not key→org
- // binding.
- const organizationId = await getOrCreateDefaultHostedOrganization(
- userId,
- (body) => authApi.createOrganization({ body }),
- );
+ // API keys bill the user's active organization. Keys are user-scoped and
+ // the org derives from the project each tool call names (project-level
+ // authz) — not key→org binding. Fail closed if the user has no existing
+ // memberships; we never mint a default organization for an API key.
+ const resolved = await resolveExistingActiveHostedOrganization(userId);
+ if (!resolved) {
+ return apiKeyErrorResponse({
+ code: "FORBIDDEN",
+ message: "API key is not associated with an organization",
+ });
+ }
+ const { organizationId, role } = resolved;
// clientId "api_key" satisfies the hosted transport's fail-closed props
// schema and counts these calls as external MCP clients in telemetry.
+ // orgScope "user": the key itself is the credential, not a key→org
+ // binding — project-scoped tools authorize per call via the caller's
+ // membership in the project's org, and organizationId above is only the
+ // fallback for tools with no project argument.
const props = createWorkersOAuthMcpProps({
userId,
userEmail: user.email,
organizationId,
+ role,
+ orgScope: "user",
baseUrl: getHostedBaseUrl(),
scopes: [...MCP_OAUTH_SCOPES],
clientId: "api_key",
diff --git a/src/server/mcp/context.ts b/src/server/mcp/context.ts
index ef57c04..795ab1d 100644
--- a/src/server/mcp/context.ts
+++ b/src/server/mcp/context.ts
@@ -7,6 +7,18 @@ export type ToolAuthContext = {
userId: string;
userEmail: string;
organizationId: string;
+ // Org role for permission gates (owner/admin/member, comma-joined when
+ // multiple). Hosted: stamped per request from the member row in
+ // transport.ts. Self-host/delegated: one implicit user per org → "owner".
+ role: string;
+ // How tool calls bind to an organization. "pinned": the request's
+ // organizationId is the authorization boundary — OAuth tokens (org stamped
+ // at consent) and self-host. "user": the credential is user-scoped (API
+ // keys) — project-scoped tools derive the org from the project row and
+ // authorize via the caller's membership in THAT org, so one key works
+ // across every organization the user belongs to; organizationId is only the
+ // fallback context for the few tools with no project argument.
+ orgScope: "pinned" | "user";
scopes: string[];
clientId: string | null;
baseUrl: string;
@@ -23,6 +35,12 @@ const applicationAuthContextSchema = z.object({
userId: z.string().min(1),
userEmail: z.string().min(1),
organizationId: z.string().min(1),
+ // Absent from OAuth grant props (role is stamped per request by the hosted
+ // transport, never baked into tokens) and from delegated modes (implicit
+ // owner).
+ role: z.string().min(1).optional(),
+ // Absent everywhere except the API-key path; absent means "pinned".
+ orgScope: z.enum(["pinned", "user"]).optional(),
baseUrl: z.string().url(),
// Compatibility fallback until workers-oauth-provider supplies the verified
// context marker consumed by Agents SDK 0.20.x (the
@@ -75,10 +93,23 @@ export function createMcpToolContext(
const authInfo = context.http?.authInfo;
const clientId = authInfo?.clientId ?? applicationAuth.clientId ?? null;
const scopes = authInfo?.scopes ?? applicationAuth.scopes ?? [];
+ const orgScope = applicationAuth.orgScope ?? "pinned";
+ // Delegated/self-hosted modes have no member rows and a single implicit owner
+ // per org; "pinned" without a role means owner. API keys ("user" scope) must
+ // stamp the role from the user's active org membership in api-key-auth.ts.
+ const role =
+ applicationAuth.role ?? (orgScope === "pinned" ? "owner" : undefined);
+ if (!role) {
+ throw new Error(
+ "MCP auth context is missing a role for a user-scoped credential",
+ );
+ }
return {
auth: {
...applicationAuth,
+ role,
+ orgScope,
clientId,
scopes,
},
diff --git a/src/server/mcp/instrumentation.test.ts b/src/server/mcp/instrumentation.test.ts
index 5191134..239e9bd 100644
--- a/src/server/mcp/instrumentation.test.ts
+++ b/src/server/mcp/instrumentation.test.ts
@@ -44,6 +44,8 @@ const authContext: ToolAuthContext = {
userId: "user-1",
userEmail: "user@example.com",
organizationId: "org-1",
+ role: "owner",
+ orgScope: "pinned",
clientId: "client-1",
scopes: ["mcp"],
baseUrl: "https://app.openseo.so",
diff --git a/src/server/mcp/project-auth.test.ts b/src/server/mcp/project-auth.test.ts
index 10d42f2..3a876ed 100644
--- a/src/server/mcp/project-auth.test.ts
+++ b/src/server/mcp/project-auth.test.ts
@@ -3,11 +3,20 @@ import { makeToolContext } from "@/server/mcp/tools/tool-test-support";
const mocks = vi.hoisted(() => ({
getProjectForOrganization: vi.fn(),
+ getProjectWithOrganization: vi.fn(),
+ getMembership: vi.fn(),
}));
vi.mock("@/server/features/projects/services/ProjectService", () => ({
ProjectService: {
getProjectForOrganization: mocks.getProjectForOrganization,
+ getProjectWithOrganization: mocks.getProjectWithOrganization,
+ },
+}));
+
+vi.mock("@/server/auth/repositories/AuthRepository", () => ({
+ AuthRepository: {
+ getMembership: mocks.getMembership,
},
}));
@@ -55,6 +64,8 @@ describe("withMcpProjectAuth", () => {
userId: "user_123",
userEmail: "alice@example.com",
organizationId: "org_123",
+ role: "owner",
+ orgScope: "pinned",
clientId: "client_123",
scopes: ["mcp"],
},
@@ -105,3 +116,77 @@ describe("withMcpProjectAuth", () => {
expect(handler).not.toHaveBeenCalled();
});
});
+
+// User-scoped credentials (API keys): the org derives from the project and
+// access is the caller's membership in that org — never the request's
+// organizationId.
+describe("withMcpProjectAuth with a user-scoped credential", () => {
+ const userScopedContext = makeToolContext({ orgScope: "user" });
+
+ beforeEach(() => {
+ vi.resetModules();
+ mocks.getProjectWithOrganization.mockResolvedValue({
+ organizationId: "org_other",
+ project: {
+ id: "project_123",
+ name: "Test",
+ locationCode: 2840,
+ languageCode: "en",
+ },
+ });
+ mocks.getMembership.mockResolvedValue({ role: "admin" });
+ });
+
+ it("rebinds auth and billing to the project's org and the member's role there", async () => {
+ const { withMcpProjectAuth } = await import("@/server/mcp/project-auth");
+ const handler = vi.fn<
+ (
+ args: { projectId: string },
+ context: {
+ auth: { organizationId: string; role: string };
+ billing: { organizationId: string };
+ },
+ ) => string
+ >(() => "ok");
+
+ await withMcpProjectAuth(handler)(
+ { projectId: "project_123" },
+ userScopedContext,
+ );
+
+ expect(mocks.getMembership).toHaveBeenCalledWith("user_123", "org_other");
+ expect(mocks.getProjectForOrganization).not.toHaveBeenCalled();
+ const [, context] = handler.mock.calls[0];
+ expect(context.auth.organizationId).toBe("org_other");
+ expect(context.auth.role).toBe("admin");
+ expect(context.billing.organizationId).toBe("org_other");
+ });
+
+ it("rejects when the caller has no membership in the project's org", async () => {
+ mocks.getMembership.mockResolvedValue(null);
+ const { withMcpProjectAuth } = await import("@/server/mcp/project-auth");
+ const handler = vi.fn();
+
+ await expect(
+ withMcpProjectAuth(handler)(
+ { projectId: "project_123" },
+ userScopedContext,
+ ),
+ ).rejects.toThrow("FORBIDDEN");
+
+ expect(handler).not.toHaveBeenCalled();
+ });
+
+ it("rejects an unknown project without leaking whether it exists", async () => {
+ mocks.getProjectWithOrganization.mockResolvedValue(null);
+ const { withMcpProjectAuth } = await import("@/server/mcp/project-auth");
+ const handler = vi.fn();
+
+ await expect(
+ withMcpProjectAuth(handler)({ projectId: "missing" }, userScopedContext),
+ ).rejects.toThrow("FORBIDDEN");
+
+ expect(mocks.getMembership).not.toHaveBeenCalled();
+ expect(handler).not.toHaveBeenCalled();
+ });
+});
diff --git a/src/server/mcp/project-auth.ts b/src/server/mcp/project-auth.ts
index 1f5c6b6..9334472 100644
--- a/src/server/mcp/project-auth.ts
+++ b/src/server/mcp/project-auth.ts
@@ -1,3 +1,4 @@
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
import { ProjectService } from "@/server/features/projects/services/ProjectService";
import { AppError } from "@/server/lib/errors";
import { buildBillingCustomer, type ToolContext } from "@/server/mcp/context";
@@ -12,6 +13,34 @@ async function requireProjectAccess(
) {
const { baseUrl, ...auth } = toolContext.auth;
+ // User-scoped credentials (API keys) have no org binding: derive the org
+ // from the project row, then authorize via the caller's membership in that
+ // org. The returned auth is rebound to the project's org + the member's
+ // role there, so billing and every downstream org read follow the project.
+ if (auth.orgScope === "user") {
+ const resolved = await ProjectService.getProjectWithOrganization(projectId);
+ const membership = resolved
+ ? await AuthRepository.getMembership(auth.userId, resolved.organizationId)
+ : null;
+ // One FORBIDDEN for both unknown project and non-membership, so probing
+ // with foreign project ids can't distinguish "exists" from "no access".
+ if (!resolved || !membership) {
+ throw new AppError("FORBIDDEN");
+ }
+
+ const projectAuth = {
+ ...auth,
+ organizationId: resolved.organizationId,
+ role: membership.role,
+ };
+ return {
+ auth: projectAuth,
+ baseUrl,
+ billing: buildBillingCustomer(projectAuth, projectId),
+ project: resolved.project,
+ };
+ }
+
// Authorize the caller-supplied projectId against the token's organization.
// Assert on the result instead of relying on the lookup throwing, so this
// stays a hard gate even if the service's error behavior ever changes.
diff --git a/src/server/mcp/tools/create-project.test.ts b/src/server/mcp/tools/create-project.test.ts
index 3faeef6..03eae7d 100644
--- a/src/server/mcp/tools/create-project.test.ts
+++ b/src/server/mcp/tools/create-project.test.ts
@@ -4,6 +4,7 @@ import { makeToolContext } from "./tool-test-support";
const mocks = vi.hoisted(() => ({
createProject: vi.fn(),
+ listMembershipsForUser: vi.fn(),
}));
vi.mock("@/server/features/projects/services/ProjectService", () => ({
@@ -12,6 +13,12 @@ vi.mock("@/server/features/projects/services/ProjectService", () => ({
},
}));
+vi.mock("@/server/auth/repositories/AuthRepository", () => ({
+ AuthRepository: {
+ listMembershipsForUser: mocks.listMembershipsForUser,
+ },
+}));
+
const toolContext = makeToolContext();
describe("create_project MCP tool", () => {
@@ -94,4 +101,83 @@ describe("create_project MCP tool", () => {
);
expect(mocks.createProject).not.toHaveBeenCalled();
});
+
+ it("rejects a foreign organizationId on a organization-bound (pinned) connection", async () => {
+ await expect(
+ createProjectTool.handler(
+ { name: "Acme", organizationId: "org_other" },
+ toolContext,
+ ),
+ ).rejects.toThrow("bound to a single organization");
+ expect(mocks.createProject).not.toHaveBeenCalled();
+ });
+
+ it("rejects a member role from creating projects", async () => {
+ const memberContext = makeToolContext({ role: "member" });
+
+ await expect(
+ createProjectTool.handler({ name: "Acme" }, memberContext),
+ ).rejects.toMatchObject({ code: "FORBIDDEN" });
+ expect(mocks.createProject).not.toHaveBeenCalled();
+ });
+});
+
+// User-scoped credentials (API keys): the target organization must be
+// unambiguous — a single membership resolves implicitly, multiple require an
+// explicit, membership-checked organizationId confirmed with the user.
+describe("create_project with a user-scoped credential", () => {
+ const userScopedContext = makeToolContext({ orgScope: "user" });
+ const memberships = [
+ { organizationId: "org_a", organizationName: "Alpha", role: "owner" },
+ { organizationId: "org_b", organizationName: "Beta", role: "admin" },
+ ];
+
+ beforeEach(() => {
+ mocks.createProject.mockResolvedValue({
+ id: "project_new",
+ name: "Acme",
+ domain: null,
+ locationCode: 2840,
+ languageCode: "en",
+ });
+ mocks.listMembershipsForUser.mockResolvedValue(memberships);
+ });
+
+ it("errors with the organization list when no organizationId is given and the user has several", async () => {
+ await expect(
+ createProjectTool.handler({ name: "Acme" }, userScopedContext),
+ ).rejects.toThrow(/org_a {2}Alpha[\s\S]*org_b {2}Beta/);
+ expect(mocks.createProject).not.toHaveBeenCalled();
+ });
+
+ it("creates in the named organization when the user is a member of it", async () => {
+ await createProjectTool.handler(
+ { name: "Acme", organizationId: "org_b" },
+ userScopedContext,
+ );
+
+ expect(mocks.createProject).toHaveBeenCalledWith("org_b", {
+ name: "Acme",
+ });
+ });
+
+ it("rejects a organizationId the user is not a member of", async () => {
+ await expect(
+ createProjectTool.handler(
+ { name: "Acme", organizationId: "org_stranger" },
+ userScopedContext,
+ ),
+ ).rejects.toThrow("not a member");
+ expect(mocks.createProject).not.toHaveBeenCalled();
+ });
+
+ it("resolves implicitly when the user belongs to exactly one organization", async () => {
+ mocks.listMembershipsForUser.mockResolvedValue([memberships[0]]);
+
+ await createProjectTool.handler({ name: "Acme" }, userScopedContext);
+
+ expect(mocks.createProject).toHaveBeenCalledWith("org_a", {
+ name: "Acme",
+ });
+ });
});
diff --git a/src/server/mcp/tools/create-project.ts b/src/server/mcp/tools/create-project.ts
index 55101bc..1578163 100644
--- a/src/server/mcp/tools/create-project.ts
+++ b/src/server/mcp/tools/create-project.ts
@@ -1,3 +1,5 @@
+import { requireOrgPermission } from "@/server/auth/org-gate";
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
import { ProjectService } from "@/server/features/projects/services/ProjectService";
import { AppError } from "@/server/lib/errors";
import { mcpResponse } from "@/server/mcp/formatters";
@@ -33,10 +35,68 @@ const inputSchema = {
.describe(
'Optional language code (e.g. "en", "fr"). Requires locationCode; derived from the location when omitted.',
),
+ organizationId: z
+ .string()
+ .trim()
+ .min(1)
+ .optional()
+ .describe(
+ "Organization id to create the project in. Required when the user belongs to more than one organization — omitting it returns the list; confirm the choice with the user before retrying.",
+ ),
} as const;
type Args = z.infer>;
+// Which organization gets the project. Pinned credentials (OAuth tokens,
+// self-host, SAM) are bound to one org. User-scoped credentials (API keys)
+// span organizations, so an ambiguous target is an error listing the options —
+// the agent must confirm the choice with the user rather than guessing.
+async function resolveTargetOrganization(
+ auth: Omit,
+ organizationId: string | undefined,
+) {
+ if (auth.orgScope !== "user") {
+ if (organizationId && organizationId !== auth.organizationId) {
+ throw new AppError(
+ "FORBIDDEN",
+ "This connection is bound to a single organization — omit organizationId.",
+ );
+ }
+ return { organizationId: auth.organizationId, role: auth.role };
+ }
+
+ const memberships = await AuthRepository.listMembershipsForUser(auth.userId);
+ if (organizationId) {
+ const membership = memberships.find(
+ (candidate) => candidate.organizationId === organizationId,
+ );
+ if (!membership) {
+ throw new AppError(
+ "FORBIDDEN",
+ "The user is not a member of that organization.",
+ );
+ }
+ return { organizationId, role: membership.role };
+ }
+ if (memberships.length === 1) {
+ const only = memberships[0];
+ return { organizationId: only.organizationId, role: only.role };
+ }
+ if (memberships.length === 0) {
+ throw new AppError("FORBIDDEN");
+ }
+ const organizationList = memberships
+ .map(
+ (membership) =>
+ `- ${membership.organizationId} ${membership.organizationName}`,
+ )
+ .join("\n");
+ throw new AppError(
+ "VALIDATION_ERROR",
+ `The user belongs to ${memberships.length} organizations. Ask the user which organization this project should be created in, then retry with organizationId set:\n${organizationList}`,
+ );
+}
+
export const createProjectTool = {
name: "create_project",
config: {
@@ -65,10 +125,16 @@ export const createProjectTool = {
},
handler: async (args: Args, context: ToolContext) => {
const { baseUrl, ...auth } = context.auth;
+ const target = await resolveTargetOrganization(auth, args.organizationId);
+ // Same gate as the createProject server function — MCP and the dashboard
+ // must agree on who can create projects. The role is the caller's role
+ // in the TARGET organization, not the request-level one.
+ requireOrgPermission(target, { project: ["create"] });
// Reuse the app's create schema so the market pair rule (a languageCode
// requires a locationCode) and domain normalization match the dashboard.
// A rejection is bad caller input, not a fault: VALIDATION_ERROR keeps it
- // out of error reporting while still naming the bad field.
+ // out of error reporting while still naming the bad field. organizationId
+ // is stripped here — it was consumed above.
const parsedInput = createProjectSchema.safeParse(args);
if (!parsedInput.success) {
throw new AppError(
@@ -78,7 +144,7 @@ export const createProjectTool = {
}
const input = parsedInput.data;
const project = await ProjectService.createProject(
- auth.organizationId,
+ target.organizationId,
input,
);
return mcpResponse({
diff --git a/src/server/mcp/tools/list-projects.ts b/src/server/mcp/tools/list-projects.ts
index 6ab5064..b5fa3d4 100644
--- a/src/server/mcp/tools/list-projects.ts
+++ b/src/server/mcp/tools/list-projects.ts
@@ -1,3 +1,4 @@
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
import { ProjectService } from "@/server/features/projects/services/ProjectService";
import { mcpResponse } from "@/server/mcp/formatters";
import { type ToolContext } from "@/server/mcp/context";
@@ -5,12 +6,42 @@ import { optionalMetaOutputSchema } from "@/server/mcp/output-schemas";
import { buildDashboardUrl } from "@/server/mcp/urls";
import { z } from "zod";
+// The org(s) whose projects the caller can see. Pinned credentials (OAuth
+// tokens, self-host) see the bound org; user-scoped credentials (API keys)
+// see every organization the user belongs to, labeled so the agent can tell
+// same-named projects apart.
+async function listVisibleProjects(auth: Omit) {
+ if (auth.orgScope !== "user") {
+ const projects = await ProjectService.listProjects(auth.organizationId);
+ return projects.map((project) => ({
+ ...project,
+ organization: undefined,
+ organizationId: undefined,
+ }));
+ }
+
+ const memberships = await AuthRepository.listMembershipsForUser(auth.userId);
+ const byOrg = await Promise.all(
+ memberships.map(async (membership) => {
+ const projects = await ProjectService.listProjects(
+ membership.organizationId,
+ );
+ return projects.map((project) => ({
+ ...project,
+ organization: membership.organizationName,
+ organizationId: membership.organizationId,
+ }));
+ }),
+ );
+ return byOrg.flat();
+}
+
export const listProjectsTool = {
name: "list_projects",
config: {
title: "List projects",
description:
- "Lists all projects in the user's organization. Uses no credits — does not call DataForSEO. Use this whenever you need a `projectId` for another OpenSEO tool. Returns an array of {id, name, domain, locationCode, languageCode}; pass the `id` value as `projectId`. locationCode/languageCode are the project's default market — tools fall back to them when a call omits location/language args.",
+ "Lists the user's projects. Uses no credits — does not call DataForSEO. Use this whenever you need a `projectId` for another OpenSEO tool. Returns an array of {id, name, domain, locationCode, languageCode}; pass the `id` value as `projectId`. locationCode/languageCode are the project's default market — tools fall back to them when a call omits location/language args. When the user belongs to several organizations, each project is labeled with its organization and organizationId (pass that to create_project).",
inputSchema: {} as Record,
outputSchema: {
projects: z.array(
@@ -22,6 +53,8 @@ export const listProjectsTool = {
locationCode: z.number(),
languageCode: z.string(),
url: z.string(),
+ organization: z.string().optional(),
+ organizationId: z.string().optional(),
})
.passthrough(),
),
@@ -35,13 +68,13 @@ export const listProjectsTool = {
},
handler: async (_args: Record, context: ToolContext) => {
const { baseUrl, ...auth } = context.auth;
- const projects = await ProjectService.listProjects(auth.organizationId);
+ const projects = await listVisibleProjects(auth);
const lines =
projects.length === 0
? ["No projects yet. Create one in the dashboard."]
: projects.map(
(p) =>
- `- ${p.id} ${p.name}${p.domain ? ` (${p.domain})` : ""} market:${p.locationCode}/${p.languageCode}`,
+ `- ${p.id} ${p.name}${p.domain ? ` (${p.domain})` : ""}${p.organization ? ` organization:${p.organization} [${p.organizationId}]` : ""} market:${p.locationCode}/${p.languageCode}`,
);
return mcpResponse({
text: `Projects (${projects.length}):\n${lines.join("\n")}`,
@@ -56,6 +89,8 @@ export const listProjectsTool = {
locationCode: p.locationCode,
languageCode: p.languageCode,
url: buildDashboardUrl(baseUrl, `/p/${p.id}`),
+ ...(p.organization ? { organization: p.organization } : {}),
+ ...(p.organizationId ? { organizationId: p.organizationId } : {}),
})),
},
});
diff --git a/src/server/mcp/tools/saved-keywords-tools.test.ts b/src/server/mcp/tools/saved-keywords-tools.test.ts
index 3a34350..1af4c38 100644
--- a/src/server/mcp/tools/saved-keywords-tools.test.ts
+++ b/src/server/mcp/tools/saved-keywords-tools.test.ts
@@ -16,6 +16,12 @@ vi.mock("@/server/features/projects/services/ProjectService", () => ({
},
}));
+// project-auth imports the repository for user-scoped (API key) credentials;
+// unused here (pinned context) but keeps the db out of the module graph.
+vi.mock("@/server/auth/repositories/AuthRepository", () => ({
+ AuthRepository: { getMembership: vi.fn() },
+}));
+
vi.mock("@/server/features/keywords/services/KeywordResearchService", () => ({
KeywordResearchService: {
getSavedKeywords: mocks.getSavedKeywords,
diff --git a/src/server/mcp/tools/tool-test-support.ts b/src/server/mcp/tools/tool-test-support.ts
index 5ca5d98..8431655 100644
--- a/src/server/mcp/tools/tool-test-support.ts
+++ b/src/server/mcp/tools/tool-test-support.ts
@@ -8,6 +8,8 @@ export function makeToolContext(
userId: "user_123",
userEmail: "alice@example.com",
organizationId: "org_123",
+ role: "owner",
+ orgScope: "pinned",
clientId: "client_123",
scopes: ["mcp"],
baseUrl: "https://open-seo.test",
diff --git a/src/server/mcp/transport-v2.test.ts b/src/server/mcp/transport-v2.test.ts
index 80d65f8..1883a61 100644
--- a/src/server/mcp/transport-v2.test.ts
+++ b/src/server/mcp/transport-v2.test.ts
@@ -9,6 +9,14 @@ vi.mock("@/lib/auth", () => ({
getHostedBaseUrl: () => "https://open-seo.test",
}));
+// The hosted transport re-checks membership per request; mocking the
+// repository keeps this test off `cloudflare:workers`-backed db imports.
+vi.mock("@/server/auth/repositories/AuthRepository", () => ({
+ AuthRepository: {
+ getMembership: vi.fn(async () => ({ role: "owner" })),
+ },
+}));
+
vi.mock("@/middleware/ensure-user/cloudflareAccess", () => ({
resolveCloudflareAccessContext: vi.fn(),
}));
diff --git a/src/server/mcp/transport.test.ts b/src/server/mcp/transport.test.ts
index dfd535e..da8ce4e 100644
--- a/src/server/mcp/transport.test.ts
+++ b/src/server/mcp/transport.test.ts
@@ -17,6 +17,14 @@ const selfHostedAuthMocks = vi.hoisted(() => ({
createMcpHandler: vi.fn(),
}));
+const authRepositoryMocks = vi.hoisted(() => ({
+ getMembership: vi.fn(),
+}));
+
+vi.mock("@/server/auth/repositories/AuthRepository", () => ({
+ AuthRepository: authRepositoryMocks,
+}));
+
vi.mock("@/middleware/ensure-user/cloudflareAccess", () => ({
resolveCloudflareAccessContext:
selfHostedAuthMocks.resolveCloudflareAccessContext,
@@ -201,6 +209,10 @@ describe("handleSelfHostedOpenSeoMcpRequest", () => {
});
describe("handleAuthenticatedOpenSeoMcpRequest", () => {
+ beforeEach(() => {
+ authRepositoryMocks.getMembership.mockResolvedValue({ role: "owner" });
+ });
+
it("accepts the provider's encrypted identity and MCP scope fallback", async () => {
const props = hostedProps();
@@ -223,9 +235,14 @@ describe("handleAuthenticatedOpenSeoMcpRequest", () => {
legacy: "reject",
}),
);
- expect(selfHostedAuthMocks.createOpenSeoMcpServer).toHaveBeenCalledWith(
- props,
- );
+ // The transport stamps the per-request role into the props it hands the
+ // server; roles are never baked into tokens.
+ expect(selfHostedAuthMocks.createOpenSeoMcpServer).toHaveBeenCalledWith({
+ [MCP_AUTH_CONTEXT_PROP]: {
+ ...props[MCP_AUTH_CONTEXT_PROP],
+ role: "owner",
+ },
+ });
});
it("routes modern-era requests to the SDK handler", async () => {
@@ -288,9 +305,12 @@ describe("handleAuthenticatedOpenSeoMcpRequest", () => {
);
expect(response.status).toBe(200);
- expect(selfHostedAuthMocks.createOpenSeoMcpServer).toHaveBeenCalledWith(
- props,
- );
+ expect(selfHostedAuthMocks.createOpenSeoMcpServer).toHaveBeenCalledWith({
+ [MCP_AUTH_CONTEXT_PROP]: {
+ ...props[MCP_AUTH_CONTEXT_PROP],
+ role: "owner",
+ },
+ });
});
it.each([
@@ -335,6 +355,29 @@ describe("handleAuthenticatedOpenSeoMcpRequest", () => {
expect(response.status).toBe(403);
});
+ it("rejects a token whose user is no longer a member of the granted org", async () => {
+ // Tokens pin organizationId at consent time; once the membership is gone
+ // the token must stop working and push the client back through OAuth.
+ authRepositoryMocks.getMembership.mockResolvedValue(null);
+ const props = createWorkersOAuthMcpProps({
+ userId: "user-1",
+ userEmail: "user@example.com",
+ organizationId: "org-1",
+ baseUrl: "https://open-seo.test",
+ clientId: "client-1",
+ scopes: ["mcp"],
+ });
+
+ const response = await handleAuthenticatedOpenSeoMcpRequest(
+ createMcpRequest(),
+ props,
+ {},
+ { ...ctx, props },
+ );
+
+ expect(response.status).toBe(401);
+ });
+
it("rejects an OAuth client without the MCP scope", async () => {
const props = hostedProps(["offline_access"]);
diff --git a/src/server/mcp/transport.ts b/src/server/mcp/transport.ts
index 42faef3..b9b7d4f 100644
--- a/src/server/mcp/transport.ts
+++ b/src/server/mcp/transport.ts
@@ -20,6 +20,7 @@ import {
} from "@/server/mcp/context";
import { getPublicOrigin } from "@/server/mcp/public-origin";
import { createOpenSeoMcpServer } from "@/server/mcp/server";
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
// Mirrors the agents SDK's DEFAULT_CORS_OPTIONS so legacy responses carry the
// same CORS surface as the modern handler's.
@@ -176,7 +177,32 @@ export async function handleAuthenticatedOpenSeoMcpRequest(
return withMcpCors(new Response("Invalid Origin", { status: 403 }));
}
- return createRequestHandler(result.data, [
+ // Tokens snapshot organizationId at consent and refresh copies it verbatim,
+ // so the grant can outlive the membership (member removed, org changed).
+ // Re-check the member row per request; 401 invalid_token pushes compliant
+ // clients back through OAuth, where consent stamps their current org.
+ const authContext = result.data[MCP_AUTH_CONTEXT_PROP];
+ const membership = await AuthRepository.getMembership(
+ authContext.userId,
+ authContext.organizationId,
+ );
+ if (!membership) {
+ return new Response("Organization access revoked", {
+ status: 401,
+ headers: { "WWW-Authenticate": 'Bearer error="invalid_token"' },
+ });
+ }
+
+ // The handler would fall back to the provider-populated ctx.props on its
+ // own; passing authContext explicitly hands it the schema-validated copy
+ // (with the per-request role stamped in — roles are never baked into
+ // tokens) and keeps this path symmetrical with self-hosted, which has no
+ // ctx.props.
+ const requestProps = createWorkersOAuthMcpProps({
+ ...authContext,
+ role: membership.role,
+ });
+ return createRequestHandler(requestProps, [
hostedUrl.hostname,
SURFMIND_CHROME_EXTENSION_HOSTNAME,
])(request, env, ctx);
diff --git a/src/serverFunctions/audit.ts b/src/serverFunctions/audit.ts
index 41eefcd..afe5a28 100644
--- a/src/serverFunctions/audit.ts
+++ b/src/serverFunctions/audit.ts
@@ -1,5 +1,6 @@
import { createServerFn } from "@tanstack/react-start";
import { waitUntil } from "cloudflare:workers";
+import { requireOrgPermission } from "@/server/auth/org-gate";
import { AuditService } from "@/server/features/audit/services/AuditService";
import { captureServerEvent } from "@/server/lib/posthog";
import { requireProjectContext } from "@/serverFunctions/middleware";
@@ -77,6 +78,9 @@ export const deleteAudit = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
.validator(deleteAuditSchema)
.handler(async ({ data, context }) => {
+ // Deleting audits frees the org's free-plan capacity ceiling (a SUM over
+ // audit rows), so it gets the same destructive-action gate as archiving.
+ requireOrgPermission(context, { project: ["delete"] });
await AuditService.remove(data.auditId, context.projectId);
return { success: true };
});
diff --git a/src/serverFunctions/ga4.ts b/src/serverFunctions/ga4.ts
index a26277e..95f14f9 100644
--- a/src/serverFunctions/ga4.ts
+++ b/src/serverFunctions/ga4.ts
@@ -12,6 +12,7 @@ import {
createSelfHostedGoogleAuthorizationUrl,
GA4_INTEGRATION,
} from "@/server/features/google/selfHostedOAuth";
+import { requireOrgPermission } from "@/server/auth/org-gate";
import { isHostedServerAuthMode } from "@/server/lib/runtime-env";
import { captureServerEvent } from "@/server/lib/posthog";
import { getPublicOrigin } from "@/server/mcp/public-origin";
@@ -162,6 +163,7 @@ export const setGa4Property = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
.validator(setPropertySchema)
.handler(async ({ data, context }) => {
+ requireOrgPermission(context, { integration: ["manage"] });
const connection = await Ga4Service.setProperty({
projectId: context.projectId,
organizationId: context.organizationId,
@@ -188,6 +190,7 @@ export const disconnectGa4 = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
.validator(projectScopedSchema)
.handler(async ({ context }) => {
+ requireOrgPermission(context, { integration: ["manage"] });
await Ga4Service.disconnect({
projectId: context.projectId,
userId: context.userId,
diff --git a/src/serverFunctions/gsc.ts b/src/serverFunctions/gsc.ts
index ce43ffb..8ee1a1a 100644
--- a/src/serverFunctions/gsc.ts
+++ b/src/serverFunctions/gsc.ts
@@ -8,6 +8,7 @@ import {
createSelfHostedGoogleAuthorizationUrl,
GSC_INTEGRATION,
} from "@/server/features/google/selfHostedOAuth";
+import { requireOrgPermission } from "@/server/auth/org-gate";
import { captureServerEvent } from "@/server/lib/posthog";
import { getPublicOrigin } from "@/server/mcp/public-origin";
import { isHostedServerAuthMode } from "@/server/lib/runtime-env";
@@ -92,6 +93,7 @@ export const setGscSite = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
.validator(setSiteSchema)
.handler(async ({ data, context }) => {
+ requireOrgPermission(context, { integration: ["manage"] });
const connection = await GscService.setSite({
projectId: context.projectId,
organizationId: context.organizationId,
@@ -114,6 +116,7 @@ export const disconnectGsc = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
.validator(projectScopedSchema)
.handler(async ({ context }) => {
+ requireOrgPermission(context, { integration: ["manage"] });
await GscService.disconnect({
projectId: context.projectId,
userId: context.userId,
diff --git a/src/serverFunctions/middleware.ts b/src/serverFunctions/middleware.ts
index f2842db..9a184df 100644
--- a/src/serverFunctions/middleware.ts
+++ b/src/serverFunctions/middleware.ts
@@ -10,6 +10,7 @@ const ensuredUserContextSchema: z.ZodType = z.object({
userEmail: z.string(),
emailVerified: z.boolean(),
organizationId: z.string(),
+ role: z.string(),
project: z.any().optional(),
});
diff --git a/src/serverFunctions/organization.ts b/src/serverFunctions/organization.ts
new file mode 100644
index 0000000..e477176
--- /dev/null
+++ b/src/serverFunctions/organization.ts
@@ -0,0 +1,156 @@
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { getAuth, getHostedBaseUrl } from "@/lib/auth";
+import { hasOrgPermission } from "@/lib/org-permissions";
+import { consumeInvitationSendBudget } from "@/server/auth/invitation-send-limit";
+import { requireOrgPermission } from "@/server/auth/org-gate";
+import { AuthRepository } from "@/server/auth/repositories/AuthRepository";
+import { sendHostedInvitationEmail } from "@/server/email/loops";
+import { AppError } from "@/server/lib/errors";
+import { requireAuthenticatedContext } from "@/serverFunctions/middleware";
+
+// The client's source of truth for "who am I in this organization": the active
+// org, the caller's role from their member row (resolved server-side by
+// ensure-user), and every organization they belong to (for the switcher). Used
+// to gate billing/team UI; the server functions and better-auth endpoints
+// re-enforce every permission regardless.
+export const getOrganizationContext = createServerFn({ method: "GET" })
+ .middleware(requireAuthenticatedContext)
+ .handler(async ({ context }) => {
+ const memberships = await AuthRepository.listMembershipsForUser(
+ context.userId,
+ );
+ const active = memberships.find(
+ (membership) => membership.organizationId === context.organizationId,
+ );
+
+ return {
+ organizationId: context.organizationId,
+ organizationName: active?.organizationName ?? "Organization",
+ role: context.role,
+ organizations: memberships,
+ };
+ });
+
+// Team data for the organization settings tab. Pending invitations are
+// sensitive (invitee emails, inviter ids) and should only be visible to callers
+// who can manage invitations; the server filters them here so the client cannot
+// bypass the gate by calling the underlying endpoint directly.
+export const getTeam = createServerFn({ method: "GET" })
+ .middleware(requireAuthenticatedContext)
+ .handler(async ({ context }) => {
+ const fullOrganization = await getAuth().api.getFullOrganization({
+ headers: getRequest().headers,
+ query: { organizationId: context.organizationId },
+ });
+ if (!fullOrganization) {
+ throw new AppError("NOT_FOUND");
+ }
+
+ const canViewInvitations = hasOrgPermission(context.role, {
+ invitation: ["create"],
+ });
+ const now = Date.now();
+ const pendingInvitations = canViewInvitations
+ ? (fullOrganization.invitations ?? []).filter(
+ (invitation) =>
+ invitation.status === "pending" &&
+ new Date(invitation.expiresAt).getTime() > now,
+ )
+ : [];
+
+ return {
+ members: fullOrganization.members ?? [],
+ pendingInvitations,
+ };
+ });
+
+const switchOrganizationSchema = z.object({
+ organizationId: z.string().min(1),
+});
+
+// Switch the active organization and persist the choice so the next sign-in
+// lands in the same org (session hook reads user.lastActiveOrganizationId).
+export const switchOrganization = createServerFn({ method: "POST" })
+ .middleware(requireAuthenticatedContext)
+ .validator(switchOrganizationSchema)
+ .handler(async ({ data, context }) => {
+ const membership = await AuthRepository.getMembership(
+ context.userId,
+ data.organizationId,
+ );
+ if (!membership) {
+ throw new AppError("NOT_FOUND");
+ }
+
+ await getAuth().api.setActiveOrganization({
+ headers: getRequest().headers,
+ body: { organizationId: data.organizationId },
+ });
+ await AuthRepository.setLastActiveOrganization(
+ context.userId,
+ data.organizationId,
+ );
+
+ return { organizationId: data.organizationId };
+ });
+
+const sendInvitationSchema = z.object({ email: z.string().email() });
+
+// Invite (or re-invite) a teammate. better-auth creates the pending
+// invitation — its server-side checks (inviter must be a member with invite
+// permission, admin-only role lock, 20-pending cap) all still run — but the
+// email is sent here rather than via the plugin's sendInvitationEmail
+// callback: better-auth swallows throws from that callback, so a failed send
+// would still read as "sent". Here it fails the call. resend: true re-mails
+// an existing pending invitation with the same link and a refreshed expiry.
+export const sendTeamInvitation = createServerFn({ method: "POST" })
+ .middleware(requireAuthenticatedContext)
+ .validator(sendInvitationSchema)
+ .handler(async ({ data, context }) => {
+ // Defense in depth: fail-closed locally before touching the rate-limit
+ // budget or calling the plugin, so the budget cannot be exhausted by
+ // low-privilege callers.
+ requireOrgPermission(context, { invitation: ["create"] });
+
+ await consumeInvitationSendBudget(context.organizationId, data.email);
+
+ const invitation = await getAuth().api.createInvitation({
+ headers: getRequest().headers,
+ body: {
+ email: data.email,
+ role: "admin",
+ resend: true,
+ // Bind the invitation to the request's resolved org, not the session's
+ // active-organization hint, which can be stale after a switch.
+ organizationId: context.organizationId,
+ },
+ });
+
+ const [inviter, memberships] = await Promise.all([
+ AuthRepository.getHostedUser(context.userId),
+ AuthRepository.listMembershipsForUser(context.userId),
+ ]);
+ const organizationName =
+ memberships.find(
+ (membership) => membership.organizationId === context.organizationId,
+ )?.organizationName ?? "Organization";
+
+ try {
+ await sendHostedInvitationEmail({
+ email: data.email,
+ inviteUrl: `${getHostedBaseUrl()}/accept-invitation/${invitation.id}`,
+ organizationName,
+ inviterName: inviter?.name?.trim() || context.userEmail,
+ inviterEmail: context.userEmail,
+ });
+ } catch (error) {
+ // The invitation row exists and stays pending — surface the send
+ // failure so the inviter retries instead of assuming it landed.
+ console.error("Invitation email send failed:", error);
+ throw new AppError("UPSTREAM_UNAVAILABLE");
+ }
+
+ return { invitationId: invitation.id };
+ });
diff --git a/src/serverFunctions/projects.ts b/src/serverFunctions/projects.ts
index 90378cc..eab4351 100644
--- a/src/serverFunctions/projects.ts
+++ b/src/serverFunctions/projects.ts
@@ -1,4 +1,5 @@
import { createServerFn } from "@tanstack/react-start";
+import { requireOrgPermission } from "@/server/auth/org-gate";
import { ProjectService } from "@/server/features/projects/services/ProjectService";
import {
requireAuthenticatedContext,
@@ -25,9 +26,10 @@ export const getProjects = createServerFn({ method: "POST" })
export const createProject = createServerFn({ method: "POST" })
.middleware(requireAuthenticatedContext)
.validator(createProjectSchema)
- .handler(async ({ data, context }) =>
- ProjectService.createProject(context.organizationId, data),
- );
+ .handler(async ({ data, context }) => {
+ requireOrgPermission(context, { project: ["create"] });
+ return ProjectService.createProject(context.organizationId, data);
+ });
export const updateProject = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
@@ -53,9 +55,10 @@ export const setProjectMarket = createServerFn({ method: "POST" })
export const archiveProject = createServerFn({ method: "POST" })
.middleware(requireProjectContext)
.validator(archiveProjectSchema)
- .handler(async ({ data, context }) =>
- ProjectService.archiveProject(context.organizationId, data),
- );
+ .handler(async ({ data, context }) => {
+ requireOrgPermission(context, { project: ["delete"] });
+ return ProjectService.archiveProject(context.organizationId, data);
+ });
export const getArchivedProjects = createServerFn({ method: "POST" })
.middleware(requireAuthenticatedContext)
@@ -66,9 +69,10 @@ export const getArchivedProjects = createServerFn({ method: "POST" })
export const restoreProject = createServerFn({ method: "POST" })
.middleware(requireAuthenticatedContext)
.validator(restoreProjectSchema)
- .handler(async ({ data, context }) =>
- ProjectService.restoreProject(context.organizationId, data),
- );
+ .handler(async ({ data, context }) => {
+ requireOrgPermission(context, { project: ["delete"] });
+ return ProjectService.restoreProject(context.organizationId, data);
+ });
export const getProjectAccess = createServerFn({ method: "POST" })
.middleware(requireAuthenticatedContext)