fix(webapp): scope org settings routes to caller membership (#85)

* fix(webapp): scope org settings routes to caller membership

The org settings SSO and Team routes resolved the target org from the URL
slug with no membership filter, so the only actor-side gate was ability.can.
That is not a tenant floor: the cloud RBAC plugin (and the OSS fallback) return
a permissive ability for a non-member, so an authenticated non-member could
reach these routes' loaders and actions for any org whose slug they knew,
reading its SSO/directory-sync config and passing the manage:members gate on
set-role. Confirmed cross-tenant on test-cloud (read of an enterprise org's
full SSO/dsync config, and the set-role gate open) before this fix.

Resolve the org through members: { some: { userId } } in both routes' context
callbacks (new resolveOrgIdFromSlugForUser beside the unscoped resolver, and a
membership filter on the sso route's local resolveOrg). A non-member now
resolves to no org, which the dashboard route builder treats as no scope and
fails closed.

* test(webapp): cover the org-membership tenant floor on the settings resolvers

Adds a postgres regression test: resolveOrgIdFromSlugForUser returns the org id
for a member and null for a non-member, with the unscoped resolveOrgIdFromSlug
returning the id for that same non-member to pin the gap the filter closes.
Removing the members filter fails the non-member case (revert-confirmed).

Both resolvers take optional replica/prisma clients (defaulting to the
singletons, matching createEnvironment) so the test drives them against a real
testcontainer Postgres rather than mocking.

* style(test): oxfmt the org-membership resolver test

Author: 1stvamp

apps/webapp/app/models/organization.server.ts

@@ -15,6 +15,7 @@ import {
   Prisma as PrismaNamespace,
   prisma,
   type PrismaClientOrTransaction,
+  type PrismaReplicaClient,
 } from "~/db.server";
 import { env } from "~/env.server";
 import { featuresForUrl } from "~/features.server";
@@ -41,22 +42,49 @@ const nanoid = customAlphabet("1234567890abcdef", 4);
  * miss, so replica lag never leaves a real org unresolved, which the dashboard
  * route builder treats as an unauthorized request.
  */
-export async function resolveOrgIdFromSlug(slug: string): Promise<string | null> {
-  const fromReplica = await $replica.organization.findFirst({
+export async function resolveOrgIdFromSlug(
+  slug: string,
+  replicaClient: PrismaReplicaClient = $replica,
+  prismaClient: PrismaClientOrTransaction = prisma
+): Promise<string | null> {
+  const fromReplica = await replicaClient.organization.findFirst({
     where: { slug },
     select: { id: true },
   });
   if (fromReplica) {
     return fromReplica.id;
   }
 
-  const fromPrimary = await prisma.organization.findFirst({
+  const fromPrimary = await prismaClient.organization.findFirst({
     where: { slug },
     select: { id: true },
   });
   return fromPrimary?.id ?? null;
 }
 
+/**
+ * Like `resolveOrgIdFromSlug`, but only resolves an org the user is a member of. `ability.can` is not
+ * a tenant floor (the OSS fallback and the cloud plugin both return a permissive ability for a
+ * non-member), so a route that scopes only by slug lets a non-member reach the handler; the
+ * membership filter here is the tenant floor. Returns null for a non-member, which the dashboard
+ * route builder treats as no scope and fails closed.
+ */
+export async function resolveOrgIdFromSlugForUser(
+  slug: string,
+  userId: string,
+  replicaClient: PrismaReplicaClient = $replica,
+  prismaClient: PrismaClientOrTransaction = prisma
+): Promise<string | null> {
+  const where = { slug, members: { some: { userId } } };
+  const fromReplica = await replicaClient.organization.findFirst({ where, select: { id: true } });
+  if (fromReplica) {
+    return fromReplica.id;
+  }
+
+  const fromPrimary = await prismaClient.organization.findFirst({ where, select: { id: true } });
+  return fromPrimary?.id ?? null;
+}
+
 export async function createOrganization(
   {
     title,

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.sso/route.tsx

@@ -36,6 +36,7 @@ import {
 import { Select, SelectItem } from "~/components/primitives/Select";
 import { Switch } from "~/components/primitives/Switch";
 import { prisma } from "~/db.server";
+import { getUserId } from "~/services/session.server";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { rbac } from "~/services/rbac.server";
 import { ssoController } from "~/services/sso.server";
@@ -53,11 +54,14 @@ export const meta: MetaFunction = () => [{ title: "SSO & Directory Sync | Trigge
 
 const Params = z.object({ organizationSlug: z.string() });
 
-async function resolveOrg(slug: string) {
+async function resolveOrg(slug: string, userId: string) {
+  // Scoped to membership: ability.can is not a tenant floor (the cloud RBAC
+  // plugin returns a permissive ability for a non-member), so without the
+  // members filter a non-member reaches the handler for any org slug.
   // Primary (not replica): this scopes the RBAC/entitlement checks, so lag
   // could run them against a stale/missing org.
   return prisma.organization.findFirst({
-    where: { slug },
+    where: { slug, members: { some: { userId } } },
     select: { id: true, title: true },
   });
 }
@@ -117,8 +121,10 @@ const EMPTY_SSO_STATUS = {
 export const loader = dashboardLoader(
   {
     params: Params,
-    context: async (params) => {
-      const org = await resolveOrg(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const org = await resolveOrg(params.organizationSlug, userId);
       return org ? { organizationId: org.id, orgTitle: org.title } : {};
     },
     // Plan-gated before role-gated: non-Enterprise orgs render the upsell for
@@ -211,8 +217,10 @@ const ActionSchema = z.discriminatedUnion("action", [
 export const action = dashboardAction(
   {
     params: Params,
-    context: async (params) => {
-      const org = await resolveOrg(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const org = await resolveOrg(params.organizationSlug, userId);
       return org ? { organizationId: org.id } : {};
     },
     authorization: { action: "manage", resource: { type: "sso" } },

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.team/route.tsx

@@ -43,7 +43,8 @@ import { useOrganization } from "~/hooks/useOrganizations";
 import { useUser } from "~/hooks/useUser";
 import { removeTeamMember } from "~/models/removeTeamMember.server";
 import { redirectWithSuccessMessage } from "~/models/message.server";
-import { resolveOrgIdFromSlug } from "~/models/organization.server";
+import { resolveOrgIdFromSlugForUser } from "~/models/organization.server";
+import { getUserId } from "~/services/session.server";
 import { TeamPresenter } from "~/presenters/TeamPresenter.server";
 import { getCurrentPlan, getSelfServePurchaseBlockReason } from "~/services/platform.v3.server";
 import { rbac } from "~/services/rbac.server";
@@ -77,8 +78,10 @@ const Params = z.object({
 export const loader = dashboardLoader(
   {
     params: Params,
-    context: async (params) => {
-      const orgId = await resolveOrgIdFromSlug(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const orgId = await resolveOrgIdFromSlugForUser(params.organizationSlug, userId);
       return orgId ? { organizationId: orgId } : {};
     },
     authorization: { action: "read", resource: { type: "members" } },
@@ -138,8 +141,10 @@ const SetRoleSchema = z.object({
 export const action = dashboardAction(
   {
     params: Params,
-    context: async (params) => {
-      const orgId = await resolveOrgIdFromSlug(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const orgId = await resolveOrgIdFromSlugForUser(params.organizationSlug, userId);
       return orgId ? { organizationId: orgId } : {};
     },
     // No top-level authorization — different intents have different

apps/webapp/test/resolveOrgIdFromSlugForUser.test.ts

@@ -0,0 +1,37 @@
+import { postgresTest } from "@internal/testcontainers";
+import { describe, expect, vi } from "vitest";
+
+vi.setConfig({ testTimeout: 60_000 });
+import { resolveOrgIdFromSlug, resolveOrgIdFromSlugForUser } from "~/models/organization.server";
+import {
+  createTestOrgProjectWithMember,
+  createTestUser,
+} from "./fixtures/environmentVariablesFixtures";
+
+// The org settings routes resolve their org through this helper, so a non-member resolving to null
+// is what makes the dashboard route builder fail closed. ability.can is not a tenant floor (the RBAC
+// plugin and the OSS fallback both return a permissive ability for a non-member), so without the
+// membership filter a non-member reached those routes for any org whose slug they knew: a live
+// cross-tenant read of SSO/directory-sync config and an open set-role gate, confirmed on test-cloud.
+describe("resolveOrgIdFromSlugForUser", () => {
+  postgresTest("resolves an org the user is a member of", async ({ prisma }) => {
+    const { user, organization } = await createTestOrgProjectWithMember(prisma);
+
+    const resolved = await resolveOrgIdFromSlugForUser(organization.slug, user.id, prisma, prisma);
+
+    expect(resolved).toBe(organization.id);
+  });
+
+  postgresTest("returns null for a non-member, the tenant floor", async ({ prisma }) => {
+    const { organization: target } = await createTestOrgProjectWithMember(prisma);
+    const outsider = await createTestUser(prisma);
+
+    const resolved = await resolveOrgIdFromSlugForUser(target.slug, outsider.id, prisma, prisma);
+
+    // The unscoped resolver still hands the same non-member the org id: this is the exact gap the
+    // membership filter closes, and why scoping by slug alone was the hole.
+    const unscoped = await resolveOrgIdFromSlug(target.slug, prisma, prisma);
+    expect(unscoped).toBe(target.id);
+    expect(resolved).toBeNull();
+  });
+});