fix(runtime): propagate organizationName and organizationSlug from JWT metadata (#2580)

* fix(runtime): propagate organizationName and organizationSlug from JWT metadata

The runtime withBindings() was not extracting organizationId,
organizationName, and organizationSlug from the JWT metadata when
tokenOrContext was an object. This caused MCPs to receive null for
these fields even though the Mesh proxy correctly included them in
the JWT. Also enriches the context-factory Mesh JWT flow to include
org name/slug from metadata before falling back to a DB query.

Made-with: Cursor

* fix(runtime): bump version to 1.2.11 for npm publish

Includes the fix for organizationName/organizationSlug propagation
from JWT metadata in withBindings().

Made-with: Cursor

Author: JonasJesus42

apps/mesh/src/api/routes/proxy.ts

@@ -128,7 +128,16 @@ async function createMCPProxyDoNotUseDirectly(
   if (ctx.organization && connection.organization_id !== ctx.organization.id) {
     throw new Error("Connection does not belong to the active organization");
   }
-  ctx.organization ??= { id: connection.organization_id };
+  if (!ctx.organization) {
+    const org = await ctx.db
+      .selectFrom("organization")
+      .select(["id", "slug", "name"])
+      .where("id", "=", connection.organization_id)
+      .executeTakeFirst();
+    ctx.organization = org
+      ? { id: org.id, slug: org.slug, name: org.name }
+      : { id: connection.organization_id };
+  }
 
   // Check connection status
   if (connection.status !== "active") {

apps/mesh/src/core/context-factory.ts

@@ -545,6 +545,29 @@ async function authenticateRequest(
           role = membership?.role;
         }
 
+        let organization: OrganizationContext | undefined;
+        const metaOrgId = meshJwtPayload.metadata?.organizationId;
+        if (metaOrgId) {
+          const metaName = meshJwtPayload.metadata?.organizationName;
+          const metaSlug = meshJwtPayload.metadata?.organizationSlug;
+          if (metaName || metaSlug) {
+            organization = { id: metaOrgId, name: metaName, slug: metaSlug };
+          } else {
+            const orgRow = await timings.measure(
+              "auth_query_org_for_mesh_jwt",
+              () =>
+                db
+                  .selectFrom("organization")
+                  .select(["id", "slug", "name"])
+                  .where("id", "=", metaOrgId)
+                  .executeTakeFirst(),
+            );
+            organization = orgRow
+              ? { id: orgRow.id, slug: orgRow.slug, name: orgRow.name }
+              : { id: metaOrgId };
+          }
+        }
+
         return {
           user: {
             id: meshJwtPayload.sub,
@@ -553,11 +576,7 @@ async function authenticateRequest(
           },
           role,
           permissions: meshJwtPayload.permissions,
-          organization: meshJwtPayload.metadata?.organizationId
-            ? {
-                id: meshJwtPayload.metadata?.organizationId,
-              }
-            : undefined,
+          organization,
         };
       }
     } catch {

packages/runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/runtime",
-  "version": "1.2.10",
+  "version": "1.2.11",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",

packages/runtime/src/index.ts

@@ -220,12 +220,21 @@ export const withBindings = <TEnv>({
         state?: Record<string, unknown>;
         meshUrl?: string;
         connectionId?: string;
+        organizationId?: string;
+        organizationName?: string;
+        organizationSlug?: string;
       }) ?? {};
     const appName = decoded.appName as string | undefined;
     context.authorization ??= authorization;
     context.callerApp = appName;
     context.connectionId ??=
       (decoded.connectionId as string) ?? metadata.connectionId;
+    context.organizationId ??=
+      (decoded.organizationId as string) ?? metadata.organizationId;
+    context.organizationName ??=
+      (decoded.organizationName as string) ?? metadata.organizationName;
+    context.organizationSlug ??=
+      (decoded.organizationSlug as string) ?? metadata.organizationSlug;
     context.ensureAuthenticated = AUTHENTICATED(decoded.user ?? decoded.sub);
   } else {
     context = {