polish(network-policy): fix orphaned TSDoc, trim narration comments, tidy hint JSX

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -3647,11 +3647,10 @@ async function getSessionImpl() {
     headers: hdrs,
   })
 
-  // Org IP allowlists are enforced at this chokepoint so EVERY
-  // session-authenticated request — the 180+ routes and layouts that call
-  // getSession directly, not just hybrid-auth routes — re-checks the policy.
-  // A denied member is treated as signed out. Impersonation sessions are
-  // platform tooling and exempt.
+  // Org IP allowlists are enforced at this chokepoint so every route and
+  // layout that calls getSession directly re-checks the policy, not just
+  // hybrid-auth routes. A denied member is treated as signed out.
+  // Impersonation sessions are platform tooling and exempt.
   const impersonatedBy = session
     ? (session.session as { impersonatedBy?: string | null }).impersonatedBy
     : null

apps/sim/lib/auth/network-policy.ts

@@ -97,7 +97,6 @@ export async function getNetworkPolicy(
   }
 }
 
-/** Drops the cached policy for an org so the next read is fresh. */
 export function invalidateNetworkPolicyCache(organizationId: string): void {
   policyCache.delete(organizationId)
 }
@@ -108,17 +107,6 @@ export interface NetworkPolicyDecision {
   reason?: string
 }
 
-/**
- * Enforces the member org's IP allowlist for a user. `resolveClientIp`
- * returns the trusted-proxy-resolved address ({@link getTrustedClientIp}
- * for requests, Better Auth's `session.ipAddress` at session creation).
- *
- * Fail-closed by design: when a policy is active and no trustworthy client
- * IP can be derived, access is denied — a spoofable or absent address must
- * not bypass a network restriction. `DISABLE_ORG_IP_ALLOWLIST` is the
- * break-glass for misconfigured proxy topologies. Non-members and orgs
- * without an active policy are always allowed.
- */
 const ALLOWED: NetworkPolicyDecision = { allowed: true }
 const DENIED: NetworkPolicyDecision = {
   allowed: false,
@@ -150,6 +138,17 @@ function recordDenialAudit(userId: string, organizationId: string, clientIp: str
   })
 }
 
+/**
+ * Enforces the member org's IP allowlist for a user. `resolveClientIp`
+ * returns the trusted-proxy-resolved address ({@link getTrustedClientIp}
+ * for requests, Better Auth's `session.ipAddress` at session creation).
+ *
+ * Fail-closed by design: when a policy is active and no trustworthy client
+ * IP can be derived, access is denied — a spoofable or absent address must
+ * not bypass a network restriction. `DISABLE_ORG_IP_ALLOWLIST` is the
+ * break-glass for misconfigured proxy topologies. Non-members and orgs
+ * without an active policy are always allowed.
+ */
 export async function enforceOrgNetworkPolicy(
   userId: string | null | undefined,
   resolveClientIp: () => string | null | undefined

packages/platform-authz/src/network.ts

@@ -125,7 +125,6 @@ export interface CompiledAllowlist {
   v6: Array<{ network: bigint; prefix: number }>
 }
 
-/** Compiles allowlist entries; malformed entries are silently skipped. */
 export function compileAllowlist(entries: readonly string[]): CompiledAllowlist {
   const compiled: CompiledAllowlist = { v4: [], v6: [] }
   for (const entry of entries) {