fix: auto-link users by domain, reject stale sessions#2138
Merged
Conversation
…p missing When a user authenticates but has no WorkOS organization memberships, check whether their email domain matches a verified domain on an org with an active subscription. If so, create the membership in WorkOS automatically. This closes a gap where subscriptions were provisioned without the corresponding WorkOS membership (e.g. ResponsiveAds escalation #231). Applied to /api/me, GET/POST/PUT /api/me/member-profile routes. Includes integration tests for the autoLinkByVerifiedDomain function. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
WorkOS session JWTs are validated locally without an API call, so a deleted/merged user's JWT can remain valid until expiry. This caused "not a member" errors when users authenticated with stale sessions from cleaned-up duplicate accounts. On session cache miss, verify the user exists in the local users table. If not found, kill the session and force re-login. Fails open on DB errors to avoid blocking auth during outages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
bokelley
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes Escalation #231 (ResponsiveAds member-profile auth failure).
Root cause: Matthew Snyder had a duplicate WorkOS account that was cleaned up, but stale session JWTs from the deleted account pass local validation and hit "not a member" errors downstream.
Two fixes:
Auto-link by verified domain (
membership-db.ts,member-profiles.ts,http.ts): When/api/meor member-profile routes return no WorkOS org memberships, check if the user's email domain matches a verified domain on an org with active subscription. If so, create the WorkOS membership automatically. Covers users who authenticated but were never added to their org.Stale session rejection (
auth.ts): On session cache miss, verify the authenticated user exists in the local users table. If not found, kill the session and force re-login. Catches deleted/merged WorkOS accounts with unexpired JWTs. Fails open on DB errors.Also ran:
POST /api/admin/users/sync-users— synced 1392 users, confirmed ghost account gone from WorkOSPOST /api/admin/users/sync-workos— synced 1071 orgs, removed 33 stale membershipsTest plan
🤖 Generated with Claude Code