fix(auth): check the target org's role, not the active org's, in org-SSO gates#4943
Merged
Conversation
…SSO gates isOrgAdmin/isOrgOwner read ctx.auth.user.role, which reflects the session's active org, not ctx.organization (the path-resolved target org set by resolveOrgFromPath). An owner/admin of one org could manage SSO config (read, create, enforce, delete) for a different org they only hold a lower-privileged membership in. Also recognizes comma-joined multi-role owner/admin via hasAdminRole, matching the same fix already applied to canAssignRole/AccessControl.
pedrofrxncx
enabled auto-merge (squash)
July 21, 2026 16:44
decocms Bot
pushed a commit
that referenced
this pull request
Jul 21, 2026
PR: #4943 fix(auth): check the target org's role, not the active org's, in org-SSO gates Bump type: patch - decocms (apps/mesh/package.json): 4.83.5 -> 4.83.6 Deploy-Scope: server
This was referenced Jul 21, 2026
pedrofrxncx
added a commit
that referenced
this pull request
Jul 21, 2026
…n dispatch-run (#4947) Follows #4943/#4944 hardening. `fetchModelPermissions` in dispatchRunAndWait's resume/automation re-entry path used `ctx.auth.user?.role` (the session's active-org role) instead of the path-resolved role for `input.organizationId`, letting an owner/admin of one org bypass model-tier restrictions when a dispatch targets a different, lower-privileged org. #4944 already fixed the same fetchModelPermissions call in routes.ts/key-list.ts/list-models.ts but missed this call site.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows the same bug class fixed in #4934 (member-add/update-role) and #4926 (AccessControl fast-path).
isOrgAdmin/isOrgOwnerinorg-sso.tsgated SSO config read/write/enforce/delete onctx.auth.user?.role, which reflects the session's active organization — notctx.organization(the path-resolved target org thatresolveOrgFromPathsets for/api/:org/sso/*routes). A user who is owner/admin of one org but only a plain member of another could read, create, enforce, or delete that other org's SSO config (OIDC issuer/client secret) simply by navigating to its org-scoped SSO settings route, sincectx.organization.roleis exactly the fieldresolveOrgFromPathdocuments for this purpose (apps/mesh/src/core/studio-context.ts:230-236) but the file never used it.Fix: read
ctx.organization?.roleinstead, via the existinghasAdminRolehelper (also picks up comma-joined multi-role owners/admins, matching #4926).Failure scenario + regression test:
apps/mesh/src/api/routes/org-sso.test.tsconstructs a context where the active-org role is"owner"but the target org's (ctx.organization.role) is"user"— assertsisOrgAdmin/isOrgOwnerreturnfalse. This test fails on the pre-fix code (confirmed locally by reverting the fix) and passes after.Reviewer check:
cd apps/mesh && bun test src/api/routes/org-sso.test.tsLocally verified:
bun run fmt,bunx tsc --noEmit(apps/mesh), and the targeted test above. Full CI covers the rest.Summary by cubic
Fixes org SSO access control by checking the target org’s role, not the session’s active org. Prevents users with admin/owner role in a different org from managing another org’s SSO settings.
isOrgAdminandisOrgOwnernow readctx.organization.roleand usehasAdminRole.owner.Written for commit 5e1ffd9. Summary will update on new commits.