Repository navigation
fix(api): an explicit organization_id field is the organization a write sends - #40
Merged
Merged
Conversation
…te sends A write whose JSON body named the organization also had the profile's organization appended to the query string, and the platform's parameter merge let the query copy win, so -f organization_id=<other> was silently ignored. The query copy is now dropped for object-body writes and an organization_id named as a field, on the endpoint query, or in the body suppresses injection everywhere; raw --input and non-object bodies keep the query injection so scoped calls still resolve an organization.
…an explicit organization
iAziz786
marked this pull request as ready for review
October 10, 2026 06:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec: #37
Ticket: #39
What this changes
selfhost apiwrites now carry exactly oneorganization_id, and it is the one the caller named.-f organization_id=<org>or-F organization_id=<org>sends that value in the JSON body only. The profile's organization no longer rides along on the query string, which previously won the platform's parameter merge and produced a false 404 ("Project not found") when the named organization differed from the profile's.--inputbytes, non-object JSON bodies) and body-less GETs keep query-string injection, so those requests stay scoped.projects delete, …) never sent a query copy and are untouched.Verification
cargo test: 245 passed, 0 failed (174 unit + 71 integration across 6 suites).cargo fmt --check: no new drift; only the pre-existing files listed in AGENTS.md are flagged.cargo clippy --all-targets: clean, no warnings.Wire-level tests pin the request shapes, including the reported false-404 shape:
DELETE /api/v1/platform/projects/prj_1with-f organization_id=org_othersends the bare path (no query copy) and a body carryingorg_other; the profile's organization appears nowhere.GETwith the field keeps it on the query string, one occurrence.--inputand non-object bodies keep the organization on the query string.Closes #37
Closes #39