fix(api): repair OSS auth bootstrap for legacy default scope#4395
fix(api): repair OSS auth bootstrap for legacy default scope#4395bekossy wants to merge 2 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dosubot
Bot
added
Backend
Bug Report
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1620b32ec4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| await db_manager.create_or_update_default_project( | ||
| values_to_update={ | ||
| "organization_id": workspace.organization_id, | ||
| "workspace_id": workspace.id, | ||
| "project_name": "Default", | ||
| } | ||
| ) |
There was a problem hiding this comment.
This new auth-path repair call can run concurrently on multiple first requests when a workspace has no default project, but create_or_update_default_project does a read-then-insert without a lock/unique guard. In that race, multiple is_default=True projects can be created for the same workspace, and later get_default_project_id_from_workspace uses .first() (no ordering), so request scoping becomes nondeterministic across project IDs.
Useful? React with 👍 / 👎.
| select(OrganizationDB) | ||
| .where(OrganizationDB.slug.is_(None)) | ||
| .order_by(OrganizationDB.created_at.asc()) | ||
| ) | ||
| legacy_organization = result.scalars().first() |
There was a problem hiding this comment.
When no oss-default slug is found, this fallback promotes the oldest slug IS NULL organization without checking whether it owns any workspace. If the oldest legacy org is orphaned but a newer legacy org has the real workspace, promotion still leaves workspaces empty and auth fails, even though recoverable data exists. The selection should be constrained to orgs that have at least one workspace.
Useful? React with 👍 / 👎.
Railway Preview Environment
Updated at 2026-05-21T15:02:48.922Z |
1 participant
Summary
Fixes an OSS API auth failure caused by legacy DB state where the singleton organization has no oss-default slug. The API now promotes that legacy org during default workspace resolution and self-heals a missing default project, preventing valid sessions from being rejected with cached
401auth denialsTesting
Verified locally
Added or updated tests
QA follow-up
Demo
Checklist
Contributor Resources