fix(session-policy): atomic policy save + eager clamp, asymmetric membership TTL, admin-add cache invalidation

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/session-policy/route.test.ts

@@ -138,10 +138,11 @@ describe('session policy route', () => {
       expect(response.status).toBe(200)
       const body = await response.json()
       expect(body.data.configured).toEqual({ maxSessionHours: 72, idleTimeoutHours: 48 })
-      expect(mockEagerClamp).toHaveBeenCalledWith(ORG_ID, {
-        maxSessionHours: 72,
-        idleTimeoutHours: 48,
-      })
+      expect(mockEagerClamp).toHaveBeenCalledWith(
+        ORG_ID,
+        { maxSessionHours: 72, idleTimeoutHours: 48 },
+        expect.anything()
+      )
       // The version bump rides the settings UPDATE (single round trip).
       expect(dbChainMockFns.set).toHaveBeenCalledWith(
         expect.objectContaining({ securityPolicyVersion: expect.anything() })
@@ -161,10 +162,11 @@ describe('session policy route', () => {
         routeContext
       )
       expect(response.status).toBe(200)
-      expect(mockEagerClamp).toHaveBeenCalledWith(ORG_ID, {
-        maxSessionHours: null,
-        idleTimeoutHours: null,
-      })
+      expect(mockEagerClamp).toHaveBeenCalledWith(
+        ORG_ID,
+        { maxSessionHours: null, idleTimeoutHours: null },
+        expect.anything()
+      )
     })
   })
 })

apps/sim/app/api/organizations/[id]/session-policy/route.ts

@@ -138,16 +138,23 @@ export const PUT = withRouteHandler(
       idleTimeoutHours: body.idleTimeoutHours,
     }
 
-    // The version bump rides the settings UPDATE (same row, one round trip).
-    const [updated] = await db
-      .update(organization)
-      .set({
-        sessionPolicySettings: merged,
-        securityPolicyVersion: sql`${organization.securityPolicyVersion} + 1`,
-        updatedAt: new Date(),
-      })
-      .where(eq(organization.id, organizationId))
-      .returning({ id: organization.id })
+    // Settings write (with the version bump riding the same row) and the
+    // eager clamp of existing sessions commit atomically — a stored policy is
+    // never left unenforced by a partial failure.
+    const updated = await db.transaction(async (tx) => {
+      const [row] = await tx
+        .update(organization)
+        .set({
+          sessionPolicySettings: merged,
+          securityPolicyVersion: sql`${organization.securityPolicyVersion} + 1`,
+          updatedAt: new Date(),
+        })
+        .where(eq(organization.id, organizationId))
+        .returning({ id: organization.id })
+      if (!row) return null
+      await eagerClampOrgSessions(organizationId, merged, tx)
+      return row
+    })
 
     if (!updated) {
       return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
@@ -156,8 +163,6 @@ export const PUT = withRouteHandler(
     invalidateSessionPolicyCache(organizationId)
     invalidateSecurityPolicyVersionCache(organizationId)
 
-    await eagerClampOrgSessions(organizationId, merged)
-
     logger.info('Updated organization session policy', { organizationId })
 
     recordAudit({

apps/sim/lib/auth/security-policy.ts

@@ -71,6 +71,15 @@ interface MembershipCacheEntry {
 
 const membershipCache = new Map<string, MembershipCacheEntry>()
 
+/**
+ * Negative (non-member) membership results use a much shorter TTL than
+ * positive ones: a user's cached `null` would otherwise let them dodge a new
+ * org's policy for the full TTL after joining through ANY path — including
+ * ones outside this codebase (Better Auth SSO JIT provisioning). Positive
+ * results change only through leave/transfer, which invalidate explicitly.
+ */
+const NEGATIVE_MEMBERSHIP_CACHE_TTL_MS = 15 * 1000
+
 /** Drops the cached membership for a user (call when they join/leave an org). */
 export function invalidateMembershipCache(userId: string): void {
   membershipCache.delete(userId)
@@ -90,8 +99,11 @@ export async function getMemberOrganizationId(
   if (!userId) return null
 
   const cached = membershipCache.get(userId)
-  if (cached && Date.now() - cached.fetchedAt < SECURITY_POLICY_VERSION_CACHE_TTL_MS) {
-    return cached.organizationId
+  if (cached) {
+    const ttl = cached.organizationId
+      ? SECURITY_POLICY_VERSION_CACHE_TTL_MS
+      : NEGATIVE_MEMBERSHIP_CACHE_TTL_MS
+    if (Date.now() - cached.fetchedAt < ttl) return cached.organizationId
   }
 
   try {

apps/sim/lib/auth/session-policy.ts

@@ -156,12 +156,13 @@ export async function clampExpiryForSession(
  */
 export async function eagerClampOrgSessions(
   organizationId: string,
-  policy: ResolvedSessionPolicy
+  policy: ResolvedSessionPolicy,
+  executor: Pick<typeof db, 'execute'> = db
 ): Promise<void> {
   const bounds = clampBoundsSql(policy)
   if (!bounds) return
 
-  await db.execute(sql`
+  await executor.execute(sql`
     UPDATE "session" SET expires_at = LEAST(${bounds})
     WHERE impersonated_by IS NULL
       AND user_id IN (

apps/sim/lib/billing/organizations/membership.ts

@@ -631,6 +631,10 @@ export async function ensureUserInOrganization(
 
   const result = await addUserToOrganization(params)
 
+  if (result.success) {
+    invalidateMembershipCache(params.userId)
+  }
+
   return {
     ...result,
     alreadyMember: false,