fix(auth): load project-scoped OAuth projects

Generated-By: PostHog Code
Task-Id: 07b377f9-4583-463c-b256-cc29621375e6

Author: dmarticus

packages/core/src/auth/auth.test.ts

@@ -81,6 +81,7 @@ function mockTokenResponse(
     accessToken?: string;
     refreshToken?: string;
     scopedOrgs?: string[];
+    scopedTeams?: number[];
   } = {},
 ) {
   return {
@@ -91,6 +92,7 @@ function mockTokenResponse(
       expires_in: 3600,
       token_type: "Bearer",
       scope: "",
+      scoped_teams: overrides.scopedTeams,
       scoped_organizations: overrides.scopedOrgs ?? ["org-1"],
     },
   };
@@ -1463,6 +1465,63 @@ describe("AuthService", () => {
         expect(service.getState()).toMatchObject(expectedState);
       },
     );
+
+    it("loads project-scoped OAuth access without calling the organization endpoint", async () => {
+      let orgCalls = 0;
+      let projectCalls = 0;
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async (input: string | Request) => {
+          const url = typeof input === "string" ? input : input.url;
+          if (url.includes("/api/users/@me/")) {
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                uuid: "user-1",
+                organization: { id: "org-1", name: "Org 1" },
+              }),
+            } as unknown as Response;
+          }
+          if (/\/api\/organizations\/[^/]+\/$/.test(url)) {
+            orgCalls++;
+            return { ok: false, status: 403 } as Response;
+          }
+          if (url.endsWith("/api/projects/42/")) {
+            projectCalls++;
+            return {
+              ok: true,
+              json: vi.fn().mockResolvedValue({
+                id: 42,
+                name: "Project 42",
+                organization: "org-1",
+              }),
+            } as unknown as Response;
+          }
+          return {
+            ok: true,
+            json: vi.fn().mockResolvedValue({ has_access: true }),
+          } as unknown as Response;
+        }) as unknown as typeof fetch,
+      );
+      oauthFlow.startFlow.mockResolvedValue(
+        mockTokenResponse({ scopedOrgs: [], scopedTeams: [42] }),
+      );
+
+      await service.login("us");
+
+      expect(orgCalls).toBe(0);
+      expect(projectCalls).toBe(1);
+      expect(service.getState()).toMatchObject({
+        currentOrgId: "org-1",
+        currentProjectId: 42,
+        orgProjectsMap: {
+          "org-1": {
+            orgName: "Org 1",
+            projects: [{ id: 42, name: "Project 42" }],
+          },
+        },
+      });
+    });
   });
 
   describe("switchOrg", () => {

packages/core/src/auth/auth.ts

@@ -57,6 +57,7 @@ interface InMemorySession {
   orgProjectsMap: OrgProjectsMap;
   currentOrgId: string | null;
   currentProjectId: number | null;
+  scopedProjectIds: number[];
   orgProjectsIncomplete: boolean;
 }
 
@@ -638,27 +639,36 @@ export class AuthService extends TypedEventEmitter<AuthServiceEvents> {
     options: TokenResponseOptions,
   ): Promise<InMemorySession> {
     const scopedOrgIds = tokenResponse.scoped_organizations ?? [];
-    const { accountKey, currentOrgId } = await this.fetchUserContext(
-      tokenResponse.access_token,
-      options.cloudRegion,
-    );
-    // Team-scoped tokens (required_access_level=project) can arrive with an
-    // empty scoped_organizations list — the server only populates scoped_teams.
-    // Fall back to the current org from /api/users/@me/ so the picker isn't
-    // empty; without this the user is stranded on "No projects".
-    const orgIdsToFetch =
-      scopedOrgIds.length > 0
-        ? scopedOrgIds
-        : currentOrgId
-          ? [currentOrgId]
-          : [];
-    const { map: orgProjectsMap, incomplete: orgProjectsIncomplete } =
-      await this.buildOrgProjectsMap(
+    const scopedProjectIds = tokenResponse.scoped_teams ?? [];
+    const { accountKey, currentOrgId, currentOrgName } =
+      await this.fetchUserContext(
         tokenResponse.access_token,
         options.cloudRegion,
-        orgIdsToFetch,
-        this.session?.orgProjectsMap ?? {},
       );
+    const previousMap = this.session?.orgProjectsMap ?? {};
+    const { map: orgProjectsMap, incomplete: orgProjectsIncomplete } =
+      scopedOrgIds.length > 0
+        ? await this.buildOrgProjectsMap(
+            tokenResponse.access_token,
+            options.cloudRegion,
+            scopedOrgIds,
+            previousMap,
+          )
+        : scopedProjectIds.length > 0
+          ? await this.buildScopedProjectMap(
+              tokenResponse.access_token,
+              options.cloudRegion,
+              scopedProjectIds,
+              currentOrgId,
+              currentOrgName,
+              previousMap,
+            )
+          : await this.buildOrgProjectsMap(
+              tokenResponse.access_token,
+              options.cloudRegion,
+              currentOrgId ? [currentOrgId] : [],
+              previousMap,
+            );
     const lastPrefs = accountKey
       ? this.authPreference.get(accountKey, options.cloudRegion)
       : null;
@@ -670,20 +680,110 @@ export class AuthService extends TypedEventEmitter<AuthServiceEvents> {
       lastSelectedOrgId: lastPrefs?.lastSelectedOrgId ?? null,
     });
 
+    const resolvedCurrentOrgId =
+      currentOrgId && orgProjectsMap[currentOrgId]
+        ? currentOrgId
+        : (Object.keys(orgProjectsMap)[0] ?? currentOrgId);
     const session: InMemorySession = {
       accountKey,
       accessToken: tokenResponse.access_token,
       accessTokenExpiresAt: Date.now() + tokenResponse.expires_in * 1000,
       refreshToken: tokenResponse.refresh_token,
       cloudRegion: options.cloudRegion,
       orgProjectsMap,
-      currentOrgId,
+      currentOrgId: resolvedCurrentOrgId,
       currentProjectId,
+      scopedProjectIds,
       orgProjectsIncomplete,
     };
 
     return session;
   }
+  private async buildScopedProjectMap(
+    accessToken: string,
+    cloudRegion: CloudRegion,
+    projectIds: number[],
+    currentOrgId: string | null,
+    currentOrgName: string | null,
+    previousMap: OrgProjectsMap,
+  ): Promise<{ map: OrgProjectsMap; incomplete: boolean }> {
+    let incomplete = false;
+    const map: OrgProjectsMap = {};
+
+    await Promise.all(
+      projectIds.map(async (projectId) => {
+        const result = await this.fetchScopedProject(
+          accessToken,
+          cloudRegion,
+          projectId,
+        );
+        if (!result.ok) {
+          incomplete ||= result.retryable;
+          return;
+        }
+
+        const { orgId, project } = result.data;
+        const existing = map[orgId];
+        map[orgId] = {
+          orgName:
+            existing?.orgName ??
+            (orgId === currentOrgId ? currentOrgName : null) ??
+            previousMap[orgId]?.orgName ??
+            "(unknown)",
+          projects: [...(existing?.projects ?? []), project],
+        };
+      }),
+    );
+
+    return { map, incomplete };
+  }
+  private async fetchScopedProject(
+    accessToken: string,
+    cloudRegion: CloudRegion,
+    projectId: number,
+  ): Promise<
+    | {
+        ok: true;
+        data: { orgId: string; project: { id: number; name: string } };
+      }
+    | { ok: false; retryable: boolean }
+  > {
+    try {
+      const response = await this.executeAuthenticatedFetch(
+        fetch,
+        `${getCloudUrlFromRegion(cloudRegion)}/api/projects/${projectId}/`,
+        {},
+        accessToken,
+      );
+      if (!response.ok) {
+        return { ok: false, retryable: response.status >= 500 };
+      }
+      const raw = (await response.json().catch(() => null)) as {
+        id?: unknown;
+        name?: unknown;
+        organization?: unknown;
+      } | null;
+      const responseProjectId =
+        typeof raw?.id === "number" ? raw.id : projectId;
+      const name = typeof raw?.name === "string" ? raw.name : null;
+      const orgId =
+        typeof raw?.organization === "string"
+          ? raw.organization
+          : typeof raw?.organization === "object" && raw.organization !== null
+            ? (raw.organization as { id?: unknown }).id
+            : null;
+      if (typeof orgId !== "string" || !name) {
+        return { ok: false, retryable: false };
+      }
+      return {
+        ok: true,
+        data: { orgId, project: { id: responseProjectId, name } },
+      };
+    } catch (error) {
+      this.logger.warn("Failed to fetch scoped project", { projectId, error });
+      return { ok: false, retryable: true };
+    }
+  }
   private async buildOrgProjectsMap(
     accessToken: string,
     cloudRegion: CloudRegion,
@@ -896,7 +996,11 @@ export class AuthService extends TypedEventEmitter<AuthServiceEvents> {
   private async fetchUserContext(
     accessToken: string,
     cloudRegion: CloudRegion,
-  ): Promise<{ accountKey: string | null; currentOrgId: string | null }> {
+  ): Promise<{
+    accountKey: string | null;
+    currentOrgId: string | null;
+    currentOrgName: string | null;
+  }> {
     try {
       const response = await this.executeAuthenticatedFetch(
         fetch,
@@ -906,14 +1010,18 @@ export class AuthService extends TypedEventEmitter<AuthServiceEvents> {
       );
 
       if (!response.ok) {
-        return { accountKey: null, currentOrgId: null };
+        return {
+          accountKey: null,
+          currentOrgId: null,
+          currentOrgName: null,
+        };
       }
 
       const data = (await response.json().catch(() => ({}))) as {
         uuid?: unknown;
         distinct_id?: unknown;
         email?: unknown;
-        organization?: { id?: unknown } | null;
+        organization?: { id?: unknown; name?: unknown } | null;
       };
 
       let accountKey: string | null = null;
@@ -931,11 +1039,14 @@ export class AuthService extends TypedEventEmitter<AuthServiceEvents> {
       const orgId = data.organization?.id;
       const currentOrgId =
         typeof orgId === "string" && orgId.length > 0 ? orgId : null;
+      const orgName = data.organization?.name;
+      const currentOrgName =
+        typeof orgName === "string" && orgName.length > 0 ? orgName : null;
 
-      return { accountKey, currentOrgId };
+      return { accountKey, currentOrgId, currentOrgName };
     } catch (error) {
       this.logger.warn("Failed to resolve user context", { error });
-      return { accountKey: null, currentOrgId: null };
+      return { accountKey: null, currentOrgId: null, currentOrgName: null };
     }
   }
   private requireSession(): InMemorySession {
@@ -1167,12 +1278,23 @@ export class AuthService extends TypedEventEmitter<AuthServiceEvents> {
       if (!session.orgProjectsIncomplete) return;
 
       const orgIds = Object.keys(session.orgProjectsMap);
-      const { map, incomplete } = await this.buildOrgProjectsMap(
-        session.accessToken,
-        session.cloudRegion,
-        orgIds,
-        session.orgProjectsMap,
-      );
+      const { map, incomplete } =
+        session.scopedProjectIds.length > 0
+          ? await this.buildScopedProjectMap(
+              session.accessToken,
+              session.cloudRegion,
+              session.scopedProjectIds,
+              session.currentOrgId,
+              session.orgProjectsMap[session.currentOrgId ?? ""]?.orgName ??
+                null,
+              session.orgProjectsMap,
+            )
+          : await this.buildOrgProjectsMap(
+              session.accessToken,
+              session.cloudRegion,
+              orgIds,
+              session.orgProjectsMap,
+            );
 
       // The session may have been replaced (logout, re-login) while the fetch
       // was in flight; committing the stale one would resurrect it.

packages/core/src/auth/oauth.schemas.ts

@@ -24,6 +24,7 @@ export const oAuthTokenResponse = z.object({
   token_type: z.string(),
   scope: z.string().optional().default(""),
   refresh_token: z.string(),
+  scoped_teams: z.array(z.number()).optional(),
   scoped_organizations: z.array(z.string()).optional(),
 });
 export type OAuthTokenResponse = z.infer<typeof oAuthTokenResponse>;