Fail closed on the org selector for org-scoped reads (#1488)

Author: RhysSullivan

apps/cloud/src/account/workos-account-service.ts

@@ -91,16 +91,19 @@ export const workosAccountProvider: Layer.Layer<
         ? Effect.succeed(caller.session)
         : Effect.fail<AccountUnauthorized>(new AccountUnauthorized());
 
-    // The org scope for an org-scoped request: the console URL's org (sent in
-    // the selector header) when present, else the session's own org. Membership
-    // is re-checked live, so the header is a selector, not a trust boundary —
+    // The org scope for an org-scoped request: the console URL's org, sent in
+    // the selector header. FAIL CLOSED when it's missing — the session's own
+    // org is a browser-global pinned to whichever org WorkOS last touched, so
+    // falling back to it scopes a multi-org user's request to the WRONG org
+    // (see workos-auth-provider.resolveSessionPrincipal). Membership is
+    // re-checked live, so the header is a selector, not a trust boundary —
     // and two browser tabs on different orgs each send their own header, so
     // they stay independent (see organization.ts). Yields the session +
     // resolved org, or AccountNoOrganization.
     const requireOrganization = (headers: AccountHeaders) =>
       Effect.gen(function* () {
         const session = yield* requireSession();
-        const selector = headers[ORG_SELECTOR_HEADER] ?? session.organizationId;
+        const selector = headers[ORG_SELECTOR_HEADER];
         if (!selector) {
           return yield* new AccountNoOrganization();
         }
@@ -180,9 +183,15 @@ export const workosAccountProvider: Layer.Layer<
       me: (headers) =>
         Effect.gen(function* () {
           const session = yield* requireSession();
-          // Same selector precedence as requireOrganization: the URL's org
-          // (header) drives /account/me so the shell reflects the org the tab
-          // is viewing, not a session-global active org.
+          // The ONE sanctioned fallback to the session org. /account/me is
+          // identity, not tenant data: on a bare URL (no org slug yet, so no
+          // header) it answers "which org should this browser land in", and
+          // the session's pinned org is the only candidate. Every org-scoped
+          // DATA read fails closed instead (requireOrganization above,
+          // resolveSessionPrincipal) — serving tenant data from this fallback
+          // is exactly the wrong-org connection-list bug (2026-07). With a
+          // header (any slugged URL), the URL's org drives the answer so the
+          // shell reflects the org the tab is viewing.
           const selector = headers[ORG_SELECTOR_HEADER] ?? session.organizationId;
           const org = selector
             ? yield* authorizeOrganizationSelector(session.accountId, selector).pipe(

apps/cloud/src/auth/org-selector-auth.node.test.ts

@@ -7,9 +7,11 @@ import { resolveSessionPrincipal } from "./workos-auth-provider";
 import { WorkOSClient, type WorkOSClientService } from "./workos";
 
 // The org a console request resolves to is the URL's org (sent in the
-// `x-executor-organization` selector header), not the session's stored org —
-// with the session org as the fallback for non-console callers, and live
-// membership re-checked either way. This is what makes two browser tabs on
+// `x-executor-organization` selector header) — NEVER the session's stored org.
+// The sealed cookie's org is a browser-global pinned to whichever org WorkOS
+// last touched, so a fallback to it silently scopes a multi-org user's request
+// to the wrong org; a header-less request fails closed instead. Live
+// membership is re-checked either way. This is what makes two browser tabs on
 // different orgs independent.
 
 const createdAt = new Date("2026-01-01T00:00:00.000Z");
@@ -95,10 +97,15 @@ const run = (headers: Record<string, string>) =>
   );
 
 describe("resolveSessionPrincipal · URL org selector", () => {
-  it.effect("falls back to the session org when no selector header is sent", () =>
+  it.effect("fails closed when no selector header is sent", () =>
     Effect.gen(function* () {
-      const principal = yield* run({ cookie: "wos-session=x" });
-      expect(principal.organizationId, "scopes to the session org").toBe(SESSION_ORG);
+      // No fallback to the session org: the cookie's org is browser-global
+      // and can name a different org than the tab's URL for a multi-org user.
+      const error = yield* Effect.flip(run({ cookie: "wos-session=x" }));
+      expect(error, "rejects instead of scoping to the session org").toMatchObject({
+        _tag: "NoOrganization",
+        code: "no_organization",
+      });
     }),
   );
 

apps/cloud/src/auth/workos-auth-provider.ts

@@ -16,6 +16,7 @@
 //   - invalid api key            -> Unauthorized  401 invalid_api_key
 //   - api-key org not authorized -> NoOrganization 403 no_organization
 //   - no/invalid session         -> NoOrganization 403 no_organization
+//   - session without org header -> NoOrganization 403 no_organization (fail closed)
 //   - session org not authorized -> NoOrganization 403 no_organization
 //   - no auth header             -> falls through to the sealed-session path
 // The org-resolution infra errors (`UserStoreError` / `WorkOSError`) are
@@ -86,6 +87,10 @@ const NO_ORGANIZATION_IN_SESSION = {
   code: "no_organization",
   message: "No organization in session",
 };
+const NO_ORGANIZATION_SELECTOR = {
+  code: "no_organization",
+  message: "No organization selector in request",
+};
 const INVALID_ACCESS_TOKEN = {
   code: "invalid_access_token",
   message: "Invalid or expired access token",
@@ -199,13 +204,22 @@ export const resolveSessionPrincipal = (request: Request) =>
     if (!session) {
       return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);
     }
-    // The console URL's org is the scope authority (sent as a header); the
-    // session's own org is the fallback for non-console callers. Membership is
-    // re-checked live either way — the header is a selector, not a trust
-    // boundary (see organization.ts).
-    const selector = orgSelectorFromRequest(request) ?? session.organizationId;
+    // The console URL's org is the scope authority, sent as a header on every
+    // request. FAIL CLOSED when it's missing: the sealed cookie's org is
+    // browser-global and pinned to whichever org WorkOS last touched, so
+    // falling back to it silently serves ANOTHER org's data to a multi-org
+    // user (the wrong-tenant connection-list bug, 2026-07). A header-less
+    // session call gets a clear 403 instead. Membership is re-checked live —
+    // the header is a selector, not a trust boundary (see organization.ts).
+    // A bare-URL first paint (no org in the path yet) may 403 here; that's
+    // the safe outcome — OrgSlugGate immediately canonicalizes the URL onto
+    // an org slug, the org-keyed atom registry remounts, and everything
+    // refetches with the header. `/account/me` — which deliberately DOES fall
+    // back to the session org to pick that landing org — lives on the account
+    // plane, not here.
+    const selector = orgSelectorFromRequest(request);
     if (!selector) {
-      return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);
+      return yield* new NoOrganization(NO_ORGANIZATION_SELECTOR);
     }
     const org = yield* authorizeOrganizationSelector(session.userId, selector);
     if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);

apps/cloud/src/extensions/billing/route.node.test.ts

@@ -61,21 +61,23 @@ const stubUsers = Layer.succeed(UserStoreService)({
     ),
 });
 
-const run = (headers: Record<string, string>, organizationId: string | null = SESSION_ORG) =>
+const run = (headers: Record<string, string>) =>
   resolveBillingOrganization(
     new Request("https://executor.test/api/billing/customer", { headers }),
-    { userId: MEMBER, organizationId },
+    { userId: MEMBER },
   ).pipe(Effect.provide(Layer.mergeAll(stubWorkOS, stubUsers)));
 
 describe("billing route org selector", () => {
-  it.effect("falls back to the session org when no selector header is sent", () =>
+  it.effect("fails closed when no selector header is sent", () =>
     Effect.gen(function* () {
-      const org = yield* run({});
-      expect(org.id).toBe(SESSION_ORG);
+      // No fallback to the session org: the cookie's org is browser-global
+      // and can name a different org than the tab's URL for a multi-org user.
+      const error = yield* Effect.flip(run({}));
+      expect(error).toMatchObject({ _tag: "HttpResponseError", status: 401 });
     }),
   );
 
-  it.effect("scopes billing to the URL org selector over the session org", () =>
+  it.effect("scopes billing to the URL org selector", () =>
     Effect.gen(function* () {
       const org = yield* run({ "x-executor-organization": URL_SLUG });
       expect(org.id).toBe(URL_ORG);
@@ -88,11 +90,4 @@ describe("billing route org selector", () => {
       expect(error).toMatchObject({ _tag: "HttpResponseError", status: 403 });
     }),
   );
-
-  it.effect("requires either a selector header or a session org", () =>
-    Effect.gen(function* () {
-      const error = yield* Effect.flip(run({}, null));
-      expect(error).toMatchObject({ _tag: "HttpResponseError", status: 401 });
-    }),
-  );
 });

apps/cloud/src/extensions/billing/route.ts

@@ -13,12 +13,15 @@ import {
 
 type BillingSession = {
   readonly userId: string;
-  readonly organizationId?: string | null;
 };
 
 export const resolveBillingOrganization = (request: Request, session: BillingSession) =>
   Effect.gen(function* () {
-    const selector = request.headers.get(ORG_SELECTOR_HEADER) ?? session.organizationId;
+    // FAIL CLOSED: no header, no org. The AutumnProvider always sends the
+    // URL-scoped header (see __root.tsx billingHeaders); the sealed cookie's
+    // org is a browser-global that can name a DIFFERENT org for a multi-org
+    // user (see workos-auth-provider.resolveSessionPrincipal).
+    const selector = request.headers.get(ORG_SELECTOR_HEADER);
     if (!selector) {
       return yield* new HttpResponseError({
         status: 401,

apps/cloud/src/org/auth-middleware.ts

@@ -40,7 +40,11 @@ const OrgAuthMiddleware = HttpRouter.middleware<{ provides: AuthContext }>()(
           .pipe(Effect.orElseSucceed(() => null));
         if (!result) return unauthorized();
 
-        const selector = request.headers[ORG_SELECTOR_HEADER] ?? result.organizationId;
+        // FAIL CLOSED: no header, no org — the sealed cookie's org is a
+        // browser-global pinned to whichever org WorkOS last touched, so
+        // falling back to it scopes a multi-org user's request to the WRONG
+        // org (see workos-auth-provider.resolveSessionPrincipal).
+        const selector = request.headers[ORG_SELECTOR_HEADER];
         if (!selector) return noOrganization();
 
         const org = yield* authorizeOrganizationSelector(result.userId, selector).pipe(

apps/cloud/src/routes/__root.tsx

@@ -10,6 +10,7 @@ import {
   useParams,
 } from "@tanstack/react-router";
 import { AutumnProvider } from "autumn-js/react";
+import { isValidOrgSlug } from "@executor-js/api";
 import posthog from "posthog-js";
 import { PostHogProvider } from "posthog-js/react";
 import type { FrontendErrorReporter } from "@executor-js/react/api/error-reporting";
@@ -214,6 +215,14 @@ function AuthGate({ ssrOrigin }: { ssrOrigin: string | null }) {
   // is scoped to it, so `auth.organization` IS this org when the caller is a
   // member — and `null` when the URL names an org they can't access.
   const urlOrgSlug = (useParams({ strict: false }) as { orgSlug?: string }).orgSlug;
+  // The same slug derived from the PATHNAME instead of the route params: the
+  // params resolve asynchronously (a fresh load renders once with no orgSlug,
+  // then again with it), and anything keyed on them remounts on that flap.
+  // The pathname is synchronously correct on the very first render, and it is
+  // exactly what the request header derives from (getActiveOrgSlug), so the
+  // registry scope below can never disagree with the header scope.
+  const firstSegment = location.pathname.split("/")[1] ?? "";
+  const pathnameOrgSlug = isValidOrgSlug(firstSegment) ? firstSegment : null;
 
   // The SSR gate already bounced fresh org-less document requests to
   // /create-org; this catches the MID-SESSION transitions (org deleted,
@@ -282,26 +291,42 @@ function AuthGate({ ssrOrigin }: { ssrOrigin: string | null }) {
   // /<orgB> while their cookie still points at orgA would briefly render orgA's
   // slug in the copyable URL before /account/me (URL-scoped) corrects it. The
   // URL slug is the actual request scope and is correct on the very first paint,
-  // so sourcing it from there removes that flash. Falls back to the session slug
-  // on a bare URL (which OrgSlugGate is about to canonicalize onto it anyway).
-  const scopeSlug = urlOrgSlug ?? activeSlug;
+  // so sourcing it from there removes that flash. VALIDATED (pathnameOrgSlug,
+  // not the raw route param): the `{-$orgSlug}` param also captures reserved
+  // console roots ("/integrations" → orgSlug "integrations"), which are not
+  // org scopes. Falls back to the auth org on a bare/reserved URL (which
+  // OrgSlugGate canonicalizes onto it below).
+  const scopeSlug = pathnameOrgSlug ?? activeSlug;
   const billingHeaders = scopeSlug ? { [EXECUTOR_ORG_HEADER]: scopeSlug } : undefined;
 
   return (
     <AutumnProvider pathPrefix="/api/billing" headers={billingHeaders}>
       <Sentry.ErrorBoundary fallback={<ShellErrorFallback />} showDialog={false}>
-        <ExecutorProvider connection={connection} onHandledError={captureFrontendError}>
+        {/* scopeKey ties the atom registry to the URL's org: cached query
+            results can never survive an org change, and the bare → slugged
+            canonicalization remounts the registry so anything fetched
+            header-less on first paint (rejected server-side) is refetched
+            with the org header. */}
+        <ExecutorProvider
+          connection={connection}
+          scopeKey={pathnameOrgSlug}
+          onHandledError={captureFrontendError}
+        >
           <React.Suspense fallback={<BlankScreen />}>
             <ExecutorPluginsProvider plugins={clientPlugins}>
               <OrganizationProvider
                 organizationId={auth.organization.id}
                 organizationSlug={scopeSlug}
               >
-                {/* The org header scopes every request to the URL's org, so
-                    reaching here means the caller is a member of `activeSlug`
-                    (a foreign slug already 404'd above). The gate only keeps
-                    the URL canonical — bare → /<slug>. */}
-                <OrgSlugGate activeSlug={activeSlug}>
+                {/* Canonicalize onto the URL's org, not the auth org: on first
+                    paint `auth.organization` is the SSR hint (the COOKIE's
+                    org), and canonicalizing onto that would rewrite a
+                    multi-org user's /<orgB> URL to /<orgA> during the hint
+                    window. `scopeSlug` prefers the URL slug, so a slugged URL
+                    is already canonical (a foreign slug 404'd above) and only
+                    a bare URL gets rewritten — onto the auth org, the one
+                    thing it can mean. */}
+                <OrgSlugGate activeSlug={scopeSlug}>
                   <Shell />
                   <Toaster />
                 </OrgSlugGate>