From ee7bb2dd4d7e80b1db8e4009c4c700df1845c669 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Mon, 14 Jul 2025 14:46:26 -0300
Subject: [PATCH] Fix authEnforced returning a token when org has authEnforced
 enabled

---
 backend/src/services/org/org-service.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index de518c829..aa28a1dfc 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -1274,6 +1274,8 @@ export const orgServiceFactory = ({
         message: "No pending invitation found"
       });
 
+    const organization = await orgDAL.findById(orgId);
+
     await tokenService.validateTokenForUser({
       type: TokenType.TOKEN_EMAIL_ORG_INVITATION,
       userId: user.id,
@@ -1296,6 +1298,13 @@ export const orgServiceFactory = ({
       return { user };
     }
 
+    if (
+      organization.authEnforced &&
+      !(organization.bypassOrgAuthEnabled && orgMembership.role === OrgMembershipRole.Admin)
+    ) {
+      return { user };
+    }
+
     const appCfg = getConfig();
     const token = jwt.sign(
       {