fix(authorization): create implicit organization roots - #106
Conversation
henningpokriefke
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
 The PR appears safe to merge; no actionable correctness, security, or repository-rule violations remain.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9dec9ea313
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 57d1320f74
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 051986e5a9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Production resolves the implicit root with find-or-create wherever it is needed, not only when the organization is created, so an organization that reached the store without passing through the routes still gets a root instead of parentless resources. The create route also looked the root up by external_id while the sync helper looked it up by type, so the two could disagree about which row is the root. While aligning with the production service: its update path has no way to detach a resource, so `parent_resource_id: null` now leaves the parent alone (production's update DTO types the field as an optional string and ignores a null, so this supersedes the clears-to-root behavior from 2d5e01e); the update/delete guard messages use production's wording; and role assignments are removed with their membership on membership and user deletion, the same cascade organization deletion already performs.
|
thanks ! |
2 participants
Fixes #105.
Creating an organization now creates its implicit FGA root, using the configured external ID or falling back to the organization ID. Resources created without explicit parent fields attach to that root, so organization permission checks and discovery can resolve it without a fixture workaround that the hosted API rejects.
Review guide
organization-resource.tscontains the shared create/update logic used by organization routes and seed initialization. Updating an organization preserves the root's ID and existing child links.Validation
npm exec --offline --package=bun@1.3.14 -- bun test— 1,128 passed, 0 failed for the implementation commit.npm exec --offline --package=bun@1.3.14 -- bun test src/workos/routes/organization-resource.spec.ts— all 8 passed, including two complete runs with reused external IDs and removal of root/child grants without affecting another organization.bun run typecheck,bun run build,bun run lint,bun run fmt:check,git diff --check— passed.No resource-type registry or broader authorization refactor is introduced. The existing update-route HTTP verb behavior is unchanged.