feat(web): select organization during plugin auth

[MaheshtheDev]

Summary

Add organization selection to the production plugin authorization flow, following the existing MCP consent pattern so users choose the destination organization before approving access.

Changes

• Validate plugin and callback parameters before /auth/connect performs onboarding or organization-selection transitions.
• Add a multi-organization selection step, single-organization auto-entry, and a Change action on the approval screen.
• Preserve existing plugin identity, feature descriptions, callback behavior, onboarding handling, and multi-client support.
• Send the locally selected organization ID during key issuance and preserve the current selection when activation or issuance fails.
• Keep organization state unchanged when Better Auth rejects an activation request.

Testing

• ./node_modules/.bin/biome check apps/web/app/auth/connect/page.tsx packages/lib/auth-context.tsx — passed.
• git diff --check — passed.
• Web workspace typecheck — failed on pre-existing unrelated files; neither changed file appeared in diagnostics.
• Browser verification passed for invalid callbacks, unsupported clients, and unauthenticated deep-link preservation.
• Authenticated multi-organization selection and approval were not run because no authenticated browser state or disposable organization fixtures were available.

---

Attached Images and Videos

🎥 View recording: plugin-auth-invalid-request-local.webm

🎥 View recording: plugin-auth-unauth-boundaries.webm

[plugin-auth-supermemory-biome.log]

[plugin-auth-supermemory-web-types.log]

---

Session Details

• Session: View Session
• Requested by: Mahesh Sanikommu (mahesh@supermemory.com)
• Address comments on this PR. Add (aside) to your comment to have me ignore it.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	8f063bd	Aug 24 2026, 04:15 PM

[MaheshtheDev]

• feat(web): select organization during plugin auth #1590 👈 (View in Graphite)
• main

---

How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	8f063bd	Commit Preview URL Branch Preview URL	Aug 24 2026, 04:17 PM

[claude]

Claude finished @ishaanxgupta's task in 1m 50s —— View job

---

Review Complete

• Fetch and analyze PR diff
• Review for bugs, security issues, and logic errors
• Check existing review comments to avoid duplicates
• Submit review findings

---

Overview: Adds organization selection to the plugin authorization flow, allowing users to choose which organization to connect plugins to before approving access.

Issues found: None — this looks good to ship.

Analysis:

• Security: Callback URLs are properly restricted to localhost via isValidLocalhostCallback (lines 25-36), ensuring plugins can only redirect to local development servers. The key prefix validation (lines 351-358) provides defense-in-depth to verify returned keys belong to the expected organization.

• State management: The status flow (loading → selection → approval → creating → success) is well-defined. Edge cases are handled correctly:

  • Selected organization removal is detected and gracefully recovers to selection (lines 281-292)
  • The selectedOrg derivation from organizations (lines 239-241) ensures stale org IDs return null, which is caught in handleConnect
  • Empty organizations array triggers redirect to onboarding via existing effect (lines 259-272)

• Error handling: Promise.allSettled correctly separates successes from failures when issuing keys for multiple clients. Errors return the user to the appropriate state (selection or approval) rather than a dead-end error screen.

• Request validation: Moved to a computed requestError useMemo (lines 230-238) which is cleaner than effect-based validation and shows errors immediately without flash.

Score: 10/10

Clean, defensive code with proper security boundaries and edge case handling. No inline comments needed.

---

[claude]

Overview: Adds organization selection to the plugin authorization flow, allowing users to choose which organization to connect plugins to before approving access.

Issues found: None — this looks good to ship.

Analysis:

• Security: Callback URLs are properly restricted to localhost via isValidLocalhostCallback (lines 25-36). The key prefix validation (lines 364-371) provides defense-in-depth to ensure returned keys belong to the expected organization.

• State management: The status flow (loading → selection/approval → creating → success) is well-defined. Edge cases are handled correctly:

  • Selected organization removal is detected and gracefully recovers to selection (lines 301-312)
  • The selectedOrg derivation from organizations (lines 239-241) ensures stale org IDs return null, which is caught in handleConnect
  • Single-org users skip selection and go directly to approval (lines 283-289)

• Error handling: Promise.allSettled correctly separates successes from failures when issuing keys for multiple clients. Errors return the user to the appropriate state (selection or approval) rather than a dead-end error screen.

• Request validation: Moved to a computed requestError useMemo (lines 230-238) which is cleaner than the previous effect-based approach and shows the error immediately.

Score: 10/10

Clean, defensive code with proper security boundaries and edge case handling.