The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 14, 2026 1:01am

PR Summary

Medium Risk
Changes who can manage access control and which org APIs are called; incorrect scoping could wrongly grant or deny admin UI, but logic is centralized on the server with targeted query skipping on the client.

Overview
Fixes org scoping for permission groups so management and entitlement use the workspace’s owning organization, not the caller’s active org (e.g. external members viewing another org’s workspace).

The GET /api/permission-groups/user response now includes organizationId and isOrgAdmin, computed server-side via isOrganizationAdminOrOwner against that owning org. Workspaces with no org return a clear unentitled payload. The Access Control UI reads those fields from useUserPermissionConfig instead of session/active org + client getUserRole, and only loads permission groups and roster when the user is an org admin—avoiding expected 403s for non-admins.

Admin DELETE access-control adds an explicit organizationId guard (replacing a non-null assertion).

^{Reviewed by Cursor Bugbot for commit 3c4234c. Configure here.}

Greptile Summary

This PR fixes permission-group admin gating to use the workspace's owning organization rather than the caller's active organization, so external members (users who belong to a workspace via a different org) are no longer incorrectly treated as admins of that workspace's org.

• The /api/permission-groups/user route now resolves organizationId and isOrgAdmin server-side against the workspace's owning org, and the userPermissionConfigSchema contract is extended to carry both fields back to the client.
• AccessControl drops the client-side useSession / useOrganizations / getUserRole chain and reads organizationId and isOrgAdmin directly from the already-fetched userPermissionConfig, cascading queries correctly so permission groups and the org roster are only fetched for confirmed admins.
• The admin DELETE route in /api/v1/admin/access-control gains an explicit !organizationId guard before the DB query, removing a non-null assertion that was technically unsafe if the Zod contract's refine were ever relaxed.

Confidence Score: 5/5

Safe to merge — the fix correctly moves org-admin resolution to the server, all query cascades are properly gated, and every response path in the API route returns the new fields.

The core logic change is straightforward: the API route now derives both organizationId and isOrgAdmin from the workspace record rather than the session's active org. All four return sites in the route consistently include the new fields, the Zod contract is updated to match, and the component drops the now-redundant client-side role computation without leaving orphaned state. The isLoading chain correctly waits for entitlement before cascading to groups, and the admin DELETE route gains a proper null guard instead of a non-null assertion.

No files require special attention; the two-round-trip latency for org admins (userPermissionConfig must resolve before permission groups can be fetched) is intentional and well-handled by the isLoading guard.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant C as AccessControl (client)
    participant UPC as /api/permission-groups/user
    participant PG as /api/organizations/[id]/permission-groups
    participant Roster as org roster
    participant DB as Database

    C->>UPC: "GET ?workspaceId=X"
    UPC->>DB: checkWorkspaceAccess(workspaceId, userId)
    DB-->>UPC: workspace (incl. organizationId)
    alt no organizationId
        UPC-->>C: "{isOrgAdmin: false, organizationId: null, entitled: false}"
    else has organizationId
        UPC->>DB: isOrganizationAdminOrOwner(userId, orgId)
        DB-->>UPC: isOrgAdmin
        UPC->>DB: isOrganizationOnEnterprisePlan(orgId)
        DB-->>UPC: entitled
        UPC-->>C: "{isOrgAdmin, organizationId, entitled, ...}"
    end

    C->>C: "organizationId = userPermissionConfig.organizationId"
    C->>C: "currentUserIsOrgAdmin = userPermissionConfig.isOrgAdmin"

    alt "currentUserIsOrgAdmin == true"
        C->>PG: GET (fetch permission groups)
        PG-->>C: permissionGroups[]
        C->>Roster: GET (fetch org roster)
        Roster-->>C: roster[]
    end

_{Reviews (1): Last reviewed commit: "followup" | Re-trigger Greptile}