fix: greptile review comments

backend/src/db/migrations/20251127192155_adds-scope-org-id-to-identity-access-tokens.ts

@@ -3,14 +3,20 @@ import { Knex } from "knex";
 import { TableName } from "../schemas";
 
 export async function up(knex: Knex): Promise<void> {
-  await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
+  const hasScopeOrgIdColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "scopeOrgId");
-    t.uuid("scopeOrgId").notNullable();
+  if (!hasScopeOrgIdColumn) {
-    t.foreign("scopeOrgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
-  });
+      t.uuid("scopeOrgId");
+      t.foreign("scopeOrgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
 }
 
 export async function down(knex: Knex): Promise<void> {
-  await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
+  const hasScopeOrgIdColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "scopeOrgId");
-    t.dropColumn("scopeOrgId");
+  if (hasScopeOrgIdColumn) {
-  });
+    await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
+      t.dropColumn("scopeOrgId");
+    });
+  }
 }

backend/src/server/routes/v1/identity-universal-auth-router.ts

@@ -56,12 +56,12 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
         identity,
         accessTokenTTL,
         accessTokenMaxTTL
-      } = await server.services.identityUa.login(
+      } = await server.services.identityUa.login({
-        req.body.clientId,
+        clientId: req.body.clientId,
-        req.body.clientSecret,
+        clientSecret: req.body.clientSecret,
-        req.realIp,
+        ip: req.realIp,
-        req.body.subOrganizationName
+        subOrganizationName: req.body.subOrganizationName
-      );
+      });
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,

backend/src/services/auth/auth-login-service.ts

@@ -748,6 +748,33 @@ export const authLoginServiceFactory = ({
       });
     }
 
+    if (!subOrg.rootOrgId) {
+      throw new BadRequestError({
+        message: "Invalid sub-organization"
+      });
+    }
+
+    const rootOrg = await orgDAL.findById(subOrg.rootOrgId);
+
+    if (!rootOrg) {
+      throw new BadRequestError({
+        message: "Invalid root organization"
+      });
+    }
+
+    const rootOrgMembership = await membershipUserDAL.findOne({
+      actorUserId: user.id,
+      scopeOrgId: rootOrg.id,
+      scope: AccessScope.Organization,
+      status: OrgMembershipStatus.Accepted
+    });
+
+    if (!rootOrgMembership) {
+      throw new ForbiddenRequestError({
+        message: "User does not have access to the root organization"
+      });
+    }
+
     const subOrgmembershipRole = await membershipRoleDAL.findOne({ membershipId: userSubOrgMembership.id });
 
     // Check if authEnforced is true and the current auth method is not an enforced method
@@ -816,7 +843,7 @@ export const authLoginServiceFactory = ({
       user,
       userAgent,
       ip: ipAddress,
-      ...(subOrg.rootOrgId && { organizationId: subOrg.rootOrgId }),
+      organizationId: rootOrg.id,
       subOrganizationId,
       isMfaVerified: decodedToken.isMfaVerified,
       mfaMethod: decodedToken.mfaMethod

backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts

@@ -90,7 +90,7 @@ export const identityAliCloudAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -129,7 +129,7 @@ export const identityAwsAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -86,7 +86,7 @@ export const identityAzureAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -82,7 +82,7 @@ export const identityGcpAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -96,7 +96,7 @@ export const identityJwtAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -208,7 +208,7 @@ export const identityKubernetesAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts

@@ -177,7 +177,7 @@ export const identityLdapAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -86,7 +86,7 @@ export const identityOciAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -97,7 +97,7 @@ export const identityOidcAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts

@@ -95,7 +95,7 @@ export const identityTlsCertAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -515,7 +515,7 @@ export const identityTokenAuthServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,

backend/src/services/identity-ua/identity-ua-service.ts

@@ -93,7 +93,7 @@ export const identityUaServiceFactory = ({
     const org = await orgDAL.findById(identity.orgId);
     const isSubOrg = !!(org.rootOrgId || org.parentOrgId);
 
-    const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id;
+    const rootOrgId = isSubOrg ? org.rootOrgId || "" : org.id;
 
     // Resolve sub-organization if specified
     let scopeOrgId = rootOrgId;
@@ -101,7 +101,7 @@ export const identityUaServiceFactory = ({
       const subOrg = await orgDAL.findOne({ slug: subOrganizationName });
 
       if (subOrg) {
-        if (!isSubOrg || (isSubOrg && subOrg.rootOrgId === rootOrgId)) {
+        if (subOrg.rootOrgId === rootOrgId) {
           // Verify identity has membership in the sub-organization
           const subOrgMembership = await membershipIdentityDAL.findOne({
             scope: AccessScope.Organization,