fix(api): bind org GET/sync to the Clerk session org

[duyetbot]

Summary

• POST /api/v1/organizations/sync now ignores body clerk_org_id and syncs only c.get("orgId") from the verified Clerk JWT. Body name is applied only to that session org.
• GET /api/v1/organizations/:id returns 404 unless the path org is the session org, so another tenant's row is not readable.
• Adds clerk-dashboard-auth coverage for unauthenticated GET/POST, spoofed sync, and cross-org GET.

Fixes #421

Test plan

• cd packages/api && bunx vitest run test/clerk-dashboard-auth.test.ts (28 passed)
• Confirm dashboard auto-activate still syncs the active Clerk org name after merge

Summary by Sourcery

Enforce session-bound organization access in the dashboard API and harden multi-tenant isolation for Clerk-authenticated requests.

Bug Fixes:

• Ensure POST /api/v1/organizations/sync always uses the organization from the verified Clerk session instead of any client-supplied clerk_org_id.
• Restrict GET /api/v1/organizations/:id to the active session organization and return 404 for other tenants to prevent cross-org data access.
• Return 401 for organization sync and fetch endpoints when no Clerk session organization is present.

Tests:

• Expand clerk-dashboard-auth tests to cover unauthenticated organization GET/POST, spoofed sync attempts, and cross-organization GET behavior.

[sourcery-ai]

Reviewer's Guide

This PR hardens organization APIs against cross-tenant access by binding sync and lookup strictly to the Clerk session org and extends dashboard auth tests to cover unauthenticated and spoofed flows.

Sequence diagram for POST /api/v1/organizations/sync session-bound sync

sequenceDiagram
  actor Dashboard
  participant ApiRouter
  participant Session
  participant Database

  Dashboard->>ApiRouter: POST /api/v1/organizations/sync (clerk_org_id?, name)
  ApiRouter->>Session: c.get(orgId)
  alt [!orgId]
    ApiRouter-->>Dashboard: errorResponse UNAUTHORIZED 401
  else [orgId present]
    ApiRouter->>ApiRouter: parseJsonBody(c)
    ApiRouter->>ApiRouter: SyncOrgSchema.parse(body)
    ApiRouter->>Database: syncOrganization(db, clerk_org_id, name)
    Database-->>ApiRouter: org
    ApiRouter-->>Dashboard: JSON org (201 or 200)
  end

Loading

Sequence diagram for GET /api/v1/organizations/:clerkOrgId session-bound lookup

sequenceDiagram
  actor Dashboard
  participant ApiRouter
  participant Session
  participant Database

  Dashboard->>ApiRouter: GET /api/v1/organizations/:clerkOrgId
  ApiRouter->>Session: c.get(orgId)
  ApiRouter->>ApiRouter: c.req.param(clerkOrgId)
  alt [!sessionOrgId or clerkOrgId !== sessionOrgId]
    ApiRouter-->>Dashboard: errorResponse NOT_FOUND 404
  else [sessionOrgId matches clerkOrgId]
    ApiRouter->>Database: getOrganizationByClerkId(db, clerkOrgId)
    alt [!org]
      ApiRouter-->>Dashboard: errorResponse NOT_FOUND 404
    else [org found]
      ApiRouter-->>Dashboard: JSON org 200
    end
  end

Loading

File-Level Changes

Change	Details	Files
Bind POST /api/v1/organizations/sync to the Clerk session org and ignore body-supplied clerk_org_id.	Relax SyncOrgSchema so clerk_org_id is optional and documented as ignored Extract clerkOrgId from c.get("orgId") and require it, returning UNAUTHORIZED when missing Pass the verified session org id plus body name into syncOrganization instead of the raw parsed body Update syncOrganization documentation/comments to state callers must use the verified session org id	packages/api/src/routes/organizations/index.ts packages/api/src/services/organizations.ts
Restrict GET /api/v1/organizations/:id to the session org and return 404 otherwise.	Read sessionOrgId from c.get("orgId") and compare to the clerkOrgId path param Return NOT_FOUND when there is no session org or the requested org does not match the session org Keep existing lookup via getOrganizationByClerkId and NOT_FOUND behavior when the org row is missing	packages/api/src/routes/organizations/index.ts
Expand clerk-dashboard-auth tests to cover unauthenticated and cross-tenant organization access and sync behavior.	Add tests asserting 401 for GET /api/v1/organizations/:id and POST /api/v1/organizations/sync without a session Add test verifying sync ignores spoofed clerk_org_id and only updates the session org while leaving other org rows unchanged Add tests ensuring GET /api/v1/organizations/:id returns 404 for another org and 200 with the correct clerk_org_id for the session org	packages/api/test/clerk-dashboard-auth.test.ts

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#421	Ensure POST /api/v1/organizations/sync uses only the Clerk session org (c.get("orgId")) for clerk_org_id, ignores any clerk_org_id in the request body, and prevents cross-tenant overwrites.	✅
#421	Ensure GET /api/v1/organizations/:id only returns an organization when its clerkOrgId matches the Clerk session org (c.get("orgId")), otherwise responding with 404 to avoid cross-tenant reads.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Warning

Review limit reached

@duyetbot, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 110 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7c43b1ed-3729-491c-b4f7-14ca2b8fe33b

📥 Commits

Reviewing files that changed from the base of the PR and between 39c28e4 and ab2fd92.

📒 Files selected for processing (3)

• packages/api/src/routes/organizations/index.ts
• packages/api/src/services/organizations.ts
• packages/api/test/clerk-dashboard-auth.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}