feat: switched to root org id pattern

backend/src/server/plugins/auth/inject-identity.ts

@@ -20,6 +20,7 @@ export type TAuthMode =
       tokenVersionId: string; // the session id of token used
       user: TUsers;
       orgId: string;
+      rootOrgId: string;
       parentOrgId: string;
       authMethod: AuthMethod;
       isMfaVerified?: boolean;
@@ -32,6 +33,7 @@ export type TAuthMode =
       userId: string;
       user: TUsers;
       orgId: string;
+      rootOrgId: string;
       parentOrgId: string;
       token: string;
     }
@@ -41,6 +43,7 @@ export type TAuthMode =
       actor: ActorType.SERVICE;
       serviceTokenId: string;
       orgId: string;
+      rootOrgId: string;
       parentOrgId: string;
       authMethod: null;
       token: string;
@@ -51,6 +54,7 @@ export type TAuthMode =
       identityId: string;
       identityName: string;
       orgId: string;
+      rootOrgId: string;
       parentOrgId: string;
       authMethod: null;
       isInstanceAdmin?: boolean;
@@ -61,6 +65,7 @@ export type TAuthMode =
       actor: ActorType.SCIM_CLIENT;
       scimTokenId: string;
       orgId: string;
+      rootOrgId: string;
       parentOrgId: string;
       authMethod: null;
     };
@@ -145,10 +150,8 @@ export const injectIdentity = fp(
 
       switch (authMode) {
         case AuthMode.JWT: {
-          const { user, tokenVersionId, orgId, parentOrgId } = await server.services.authToken.fnValidateJwtIdentity(
-            token,
-            subOrganizationSelector
-          );
+          const { user, tokenVersionId, orgId, rootOrgId, parentOrgId } =
+            await server.services.authToken.fnValidateJwtIdentity(token, subOrganizationSelector);
           requestContext.set("orgId", orgId);
 
           req.auth = {
@@ -158,6 +161,7 @@ export const injectIdentity = fp(
             tokenVersionId,
             actor,
             orgId,
+            rootOrgId,
             parentOrgId,
             authMethod: token.authMethod,
             isMfaVerified: token.isMfaVerified,
@@ -177,6 +181,7 @@ export const injectIdentity = fp(
             authMode: AuthMode.IDENTITY_ACCESS_TOKEN,
             actor,
             orgId: identity.orgId,
+            rootOrgId: identity.rootOrgId,
             parentOrgId: identity.parentOrgId,
             identityId: identity.identityId,
             identityName: identity.name,
@@ -213,7 +218,8 @@ export const injectIdentity = fp(
 
           req.auth = {
             orgId: serviceToken.orgId,
-            parentOrgId: serviceToken.orgId,
+            rootOrgId: serviceToken.rootOrgId,
+            parentOrgId: serviceToken.parentOrgId,
             authMode: AuthMode.SERVICE_TOKEN as const,
             serviceToken,
             serviceTokenId: serviceToken.id,
@@ -235,7 +241,16 @@ export const injectIdentity = fp(
           if (subOrganizationSelector)
             throw new BadRequestError({ message: `Service token doesn't support sub organization selector` });
 
-          req.auth = { authMode: AuthMode.SCIM_TOKEN, actor, scimTokenId, orgId, authMethod: null, parentOrgId: orgId };
+          req.auth = {
+            authMode: AuthMode.SCIM_TOKEN,
+            actor,
+            scimTokenId,
+            orgId,
+            authMethod: null,
+            // scim cannot be done for sub organization
+            rootOrgId: orgId,
+            parentOrgId: orgId
+          };
           break;
         }
         default:

backend/src/server/plugins/auth/inject-permission.ts

@@ -15,6 +15,7 @@ export const injectPermission = fp(async (server) => {
         id: req.auth.userId,
         orgId: req.auth.orgId, // if the req.auth.authMode is AuthMode.API_KEY, the orgId will be "API_KEY"
         authMethod: req.auth.authMethod, // if the req.auth.authMode is AuthMode.API_KEY, the authMethod will be null
+        rootOrgId: req.auth.rootOrgId,
         parentOrgId: req.auth.parentOrgId
       };
 
@@ -27,6 +28,7 @@ export const injectPermission = fp(async (server) => {
         id: req.auth.identityId,
         orgId: req.auth.orgId,
         authMethod: null,
+        rootOrgId: req.auth.rootOrgId,
         parentOrgId: req.auth.parentOrgId
       };
 
@@ -38,7 +40,8 @@ export const injectPermission = fp(async (server) => {
         type: ActorType.SERVICE,
         id: req.auth.serviceTokenId,
         orgId: req.auth.orgId,
-        parentOrgId: req.auth.orgId,
+        rootOrgId: req.auth.rootOrgId,
+        parentOrgId: req.auth.parentOrgId,
         authMethod: null
       };
 
@@ -50,7 +53,8 @@ export const injectPermission = fp(async (server) => {
         type: ActorType.SCIM_CLIENT,
         id: req.auth.scimTokenId,
         orgId: req.auth.orgId,
-        parentOrgId: req.auth.orgId,
+        rootOrgId: req.auth.rootOrgId,
+        parentOrgId: req.auth.parentOrgId,
         authMethod: null
       };
 

backend/src/server/routes/v1/organization-router.ts

@@ -76,7 +76,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
         req.permission.id,
         req.params.organizationId,
         req.permission.authMethod,
-        req.permission.parentOrgId,
+        req.permission.rootOrgId,
         req.permission.orgId
       );
       return { organization };