fix(session-policy): resolve governing org by membership only — activeOrganizationId goes stale across transfer/leave

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -231,9 +231,7 @@ export const auth = betterAuth({
        * revocation latency becomes the policy cache TTL, not 24h.
        */
       version: async (session) =>
-        getSessionCookieCacheVersion(
-          session as { userId?: string | null; activeOrganizationId?: string | null }
-        ),
+        getSessionCookieCacheVersion(session as { userId?: string | null }),
     },
     expiresIn: 30 * 24 * 60 * 60, // 30 days (how long a session can last overall)
     updateAge: 24 * 60 * 60, // 24 hours (how often to refresh the expiry)
@@ -677,10 +675,7 @@ export const auth = betterAuth({
                 organizationId: members[0].organizationId,
               })
 
-              const expiresAt = await clampExpiryForSession({
-                ...session,
-                activeOrganizationId: members[0].organizationId,
-              })
+              const expiresAt = await clampExpiryForSession(session, members[0].organizationId)
 
               return {
                 data: {

apps/sim/lib/auth/security-policy.ts

@@ -135,16 +135,16 @@ export async function bumpSecurityPolicyVersion(organizationId: string): Promise
 /**
  * Cookie-cache version for a session, consumed by Better Auth's
  * `session.cookieCache.version`. Embeds the member org's security-policy
- * version so bumps propagate to cached cookies. The org is the session's
- * `activeOrganizationId` when present, else the user's membership — so
- * sessions created before the user joined the org are still invalidated by a
- * version bump. Sessions of non-members use the static default.
+ * version so bumps propagate to cached cookies. Resolved from the user's
+ * MEMBERSHIP, never the session's `activeOrganizationId` — that field goes
+ * stale on join/leave/transfer (it is only written at session creation), and
+ * a stale org here would let cookies dodge the destination org's version
+ * bumps for up to the 24h cookie lifetime. Sessions of non-members use the
+ * static default.
  */
 export async function getSessionCookieCacheVersion(session: {
   userId?: string | null
-  activeOrganizationId?: string | null
 }): Promise<string> {
-  const organizationId =
-    session.activeOrganizationId ?? (await getMemberOrganizationId(session.userId))
+  const organizationId = await getMemberOrganizationId(session.userId)
   return String(await getSecurityPolicyVersion(organizationId))
 }

apps/sim/lib/auth/session-policy.ts

@@ -105,31 +105,38 @@ export function clampSessionExpiry(
  */
 interface ClampableSession {
   userId?: string | null
-  activeOrganizationId?: string | null
   impersonatedBy?: string | null
   createdAt?: Date | string | null
   expiresAt?: Date | string | null
 }
 
 /**
  * Applies the org session policy to a session's proposed `expiresAt` from a
- * Better Auth database hook. The governing org is the session's
- * `activeOrganizationId` when present, else the user's membership — the same
- * resolution the cookie-cache version uses, so every member session
- * (including ones created before the user joined) is governed consistently.
- * Returns the original date when no clamp applies: impersonation sessions
- * are platform-admin tooling with their own short expiry, and non-member
+ * Better Auth database hook. The governing org is the user's MEMBERSHIP —
+ * never the session row's `activeOrganizationId`, which goes stale on
+ * join/leave/transfer — matching the cookie-cache version resolution, so
+ * every member session (including ones created before the user joined or
+ * carried across a transfer) is governed consistently. Callers that have
+ * JUST resolved the membership themselves (the session create hook) pass it
+ * as `freshMembershipOrgId` to skip the duplicate lookup. Returns the
+ * original date when no clamp applies: impersonation sessions are
+ * platform-admin tooling with their own short expiry, and non-member
  * sessions have no policy.
  */
-export async function clampExpiryForSession(session: ClampableSession): Promise<Date | undefined> {
+export async function clampExpiryForSession(
+  session: ClampableSession,
+  freshMembershipOrgId?: string | null
+): Promise<Date | undefined> {
   // Better Auth context values can cross a serialization boundary — normalize
   // date fields in case they arrive as ISO strings rather than Dates.
   const expiresAt = session.expiresAt ? new Date(session.expiresAt) : undefined
   if (!expiresAt || session.impersonatedBy) {
     return expiresAt
   }
   const organizationId =
-    session.activeOrganizationId ?? (await getMemberOrganizationId(session.userId))
+    freshMembershipOrgId !== undefined
+      ? freshMembershipOrgId
+      : await getMemberOrganizationId(session.userId)
   if (!organizationId) return expiresAt
 
   const policy = await getSessionPolicy(organizationId)