fix(auth): load projects for project-scoped OAuth

packages/core/src/auth/auth.test.ts

@@ -81,6 +81,7 @@ function mockTokenResponse(
     accessToken?: string;
     refreshToken?: string;
     scopedOrgs?: string[];
+    scopedTeams?: number[];
   } = {},
 ) {
   return {
@@ -91,6 +92,7 @@ function mockTokenResponse(
       expires_in: 3600,
       token_type: "Bearer",
       scope: "",
+      scoped_teams: overrides.scopedTeams,
       scoped_organizations: overrides.scopedOrgs ?? ["org-1"],
     },
   };
@@ -1463,6 +1465,198 @@ describe("AuthService", () => {
         expect(service.getState()).toMatchObject(expectedState);
       },
     );
+
+    // Regression for #3279: the current-org fallback still strands the picker
+    // when the backend rejects team-scoped tokens on organization endpoints.
+    it("loads project-scoped OAuth access when organization access is forbidden", async () => {
+      let orgCalls = 0;
+      let projectCalls = 0;
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async (input: string | Request) => {
+          const url = typeof input === "string" ? input : input.url;
+          if (url.includes("/api/users/@me/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                uuid: "user-1",
+                organization: { id: "org-1", name: "Org 1" },
+              }),
+            } as unknown as Response;
+          }
+          if (/\/api\/organizations\/[^/]+\/$/.test(url)) {
+            orgCalls++;
+            return { ok: false, status: 403 } as Response;
+          }
+          if (url.endsWith("/api/projects/42/")) {
+            projectCalls++;
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                id: 42,
+                name: "Project 42",
+                organization: "org-1",
+              }),
+            } as unknown as Response;
+          }
+          return {
+            ok: true,
+            json: vi.fn().mockResolvedValue({ has_access: true }),
+          } as unknown as Response;
+        }) as unknown as typeof fetch,
+      );
+      oauthFlow.startFlow.mockResolvedValue(
+        mockTokenResponse({ scopedOrgs: [], scopedTeams: [42] }),
+      );
+
+      await service.login("us");
+
+      expect(orgCalls).toBe(0);
+      expect(projectCalls).toBe(1);
+      expect(service.getState()).toMatchObject({
+        currentOrgId: "org-1",
+        currentProjectId: 42,
+        orgProjectsMap: {
+          "org-1": {
+            orgName: "Org 1",
+            projects: [{ id: 42, name: "Project 42" }],
+          },
+        },
+      });
+    });
+
+    it("merges organization and project scopes", async () => {
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async (input: string | Request) => {
+          const url = typeof input === "string" ? input : input.url;
+          if (url.includes("/api/users/@me/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                uuid: "user-1",
+                organization: { id: "org-1", name: "Org 1" },
+              }),
+            } as unknown as Response;
+          }
+          if (url.endsWith("/api/organizations/org-1/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                name: "Org 1",
+                teams: [{ id: 11, name: "Organization Project" }],
+              }),
+            } as unknown as Response;
+          }
+          if (url.endsWith("/api/projects/42/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                id: 42,
+                name: "Scoped Project",
+                organization: "org-1",
+              }),
+            } as unknown as Response;
+          }
+          return {
+            ok: true,
+            json: vi.fn().mockResolvedValue({ has_access: true }),
+          } as unknown as Response;
+        }) as unknown as typeof fetch,
+      );
+      oauthFlow.startFlow.mockResolvedValue(
+        mockTokenResponse({ scopedOrgs: ["org-1"], scopedTeams: [42] }),
+      );
+
+      await service.login("us");
+
+      expect(service.getState().orgProjectsMap["org-1"].projects).toEqual([
+        { id: 11, name: "Organization Project" },
+        { id: 42, name: "Scoped Project" },
+      ]);
+    });
+
+    it("aligns the current organization with the restored scoped project", async () => {
+      seedStoredSession({
+        selectedProjectId: 84,
+        scopeVersion: OAUTH_SCOPE_VERSION - 1,
+      });
+      await service.initialize();
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async (input: string | Request) => {
+          const url = typeof input === "string" ? input : input.url;
+          if (url.includes("/api/users/@me/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                uuid: "user-1",
+                organization: { id: "org-1", name: "Org 1" },
+              }),
+            } as unknown as Response;
+          }
+          const projectMatch = url.match(/\/api\/projects\/(42|84)\/$/);
+          if (projectMatch) {
+            const projectId = Number(projectMatch[1]);
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                id: projectId,
+                name: `Project ${projectId}`,
+                organization: projectId === 42 ? "org-1" : "org-2",
+              }),
+            } as unknown as Response;
+          }
+          return {
+            ok: true,
+            json: vi.fn().mockResolvedValue({ has_access: true }),
+          } as unknown as Response;
+        }) as unknown as typeof fetch,
+      );
+      oauthFlow.startFlow.mockResolvedValue(
+        mockTokenResponse({ scopedOrgs: [], scopedTeams: [42, 84] }),
+      );
+
+      await service.login("us");
+
+      expect(service.getState()).toMatchObject({
+        currentOrgId: "org-2",
+        currentProjectId: 84,
+      });
+    });
+
+    it("rejects authentication when a scoped project cannot be loaded permanently", async () => {
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async (input: string | Request) => {
+          const url = typeof input === "string" ? input : input.url;
+          if (url.includes("/api/users/@me/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                uuid: "user-1",
+                organization: { id: "org-1", name: "Org 1" },
+              }),
+            } as unknown as Response;
+          }
+          if (url.endsWith("/api/projects/42/")) {
+            return { ok: false, status: 403 } as Response;
+          }
+          return {
+            ok: true,
+            json: vi.fn().mockResolvedValue({ has_access: true }),
+          } as unknown as Response;
+        }) as unknown as typeof fetch,
+      );
+      oauthFlow.startFlow.mockResolvedValue(
+        mockTokenResponse({ scopedOrgs: [], scopedTeams: [42] }),
+      );
+
+      await expect(service.login("us")).rejects.toThrow(
+        "Unable to load OAuth-scoped project 42",
+      );
+      expect(service.getState().status).toBe("anonymous");
+    });
   });
 
   describe("switchOrg", () => {