fix(users): validate organisation names at write time and confirm reassignment - #169
Merged
Merged
Conversation
added 3 commits
September 18, 2026 07:32
… on reassignment adminCreateUser and assignUserRole now reject an organisation name that does not resolve to a live name-reservation row (exact match, no normalisation; tombstoned names rejected with their own message) before any Cognito write, so a claim can no longer be stamped with a value that matches no organisation. When assignUserRole changes the organisation it revokes the target's sessions with AdminUserGlobalSignOut so a stale tenancy claim cannot outlive the refresh token; the resolver role gains that single action scoped to the user pool.
…tead of comparing the client value The client-supplied orgId is no longer trusted or compared; the record, the idempotency query and the secret path all use the organisation derived from the caller's claim. The input field stays in the schema for compatibility and is ignored.
…er's tenancy The Change Organization action on an active user now opens a confirmation naming the user, the current and target organisation, and that they will be signed out of all sessions, instead of applying silently.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
adminCreateUser/assignUserRolereject an organisation name that does not resolve to a live name-reservation row (exact match, no normalisation) before any Cognito write.AdminUserGlobalSignOut, one new scoped IAM action); Team.tsx confirms the reassignment naming user, old/new organisation and the sign-out.createDataStorestamps the caller's organisation and ignores the clientorgId(schema unchanged).Resolves finding 639aeb12; client/UX half of d34ac46f (server half landed in #168).
Deploy note
NAME#row and would fail validation. Runbackend/scripts/backfill-org-name-reservations.tsagainst dev before deploying this.Verification
jest: 8090 passed, tsc cleanjest: 2097 passed, tsc clean