fix(navigation): check organization membership and availability on server

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/layout.tsx

@@ -4,6 +4,7 @@ import { redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
 import { getActiveOrganizationId } from '@/lib/auth/session-response'
 import { isMothershipModelSelectorEnabled, isPlanModeEnabled } from '@/lib/mothership/feature-flags'
+import { resolveOrganizationEntryPath } from '@/lib/navigation/resolve-app-entry'
 import { isTableRowTtlEnabled } from '@/lib/table/ttl-availability'
 import { getQueryClient } from '@/app/_shell/providers/get-query-client'
 import { ImpersonationBanner } from '@/app/workspace/[workspaceId]/components/impersonation-banner'
@@ -56,6 +57,7 @@ export default async function WorkspaceLayout({
     tableRowTtlEnabled,
     modelSelectorEnabled,
     planModeEnabled,
+    organizationHref,
   ] = await Promise.all([
     cookies(),
     hostContext.hostOrganizationId
@@ -71,6 +73,7 @@ export default async function WorkspaceLayout({
     isTableRowTtlEnabled(),
     isMothershipModelSelectorEnabled(),
     isPlanModeEnabled(),
+    resolveOrganizationEntryPath(session),
     prefetchWorkspaceAccess(queryClient, workspaceId, {
       kind: 'session',
       userId: session.user.id,
@@ -106,7 +109,7 @@ export default async function WorkspaceLayout({
                 <WorkspacePermissionsProvider>
                   <WorkspaceScopeSync />
                   <WorkspaceChrome
-                    sidebar={<Sidebar />}
+                    sidebar={<Sidebar organizationHref={organizationHref} />}
                     initialSidebarCollapsed={initialSidebarCollapsed}
                   >
                     {children}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.test.tsx

@@ -6,16 +6,11 @@ import { createRoot, type Root } from 'react-dom/client'
 import { renderToString } from 'react-dom/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockNavigateToSettings, mockWorkspacePermissions, organizationList } = vi.hoisted(() => ({
+const { mockNavigateToSettings, mockWorkspacePermissions } = vi.hoisted(() => ({
   mockNavigateToSettings: vi.fn(),
-  organizationList: { data: [] as { id: string }[] | undefined },
   mockWorkspacePermissions: { canAdmin: true, canEdit: true, canRead: true },
 }))
 
-vi.mock('@/hooks/queries/organization', () => ({
-  useOrganizationList: () => organizationList,
-}))
-
 const onWorkspaceSwitch = vi.fn()
 
 vi.mock('@tanstack/react-query', () => ({
@@ -107,6 +102,7 @@ function render(overrides: Partial<Parameters<typeof WorkspaceHeader>[0]> = {})
 function header(overrides: Partial<Parameters<typeof WorkspaceHeader>[0]> = {}) {
   return (
     <WorkspaceHeader
+      organizationHref={null}
       activeWorkspace={{ name: "Emir's Workspace" }}
       workspaceId='ws-emir'
       workspaces={WORKSPACES}
@@ -165,7 +161,6 @@ function typeInto(input: HTMLInputElement, value: string) {
 
 beforeEach(() => {
   vi.clearAllMocks()
-  organizationList.data = []
   Object.assign(mockWorkspacePermissions, { canAdmin: true, canEdit: true, canRead: true })
   // jsdom implements neither; the component scrolls the active row into view.
   Element.prototype.scrollIntoView = vi.fn()
@@ -409,21 +404,20 @@ describe('WorkspaceHeader context navigation', () => {
   it.each([null, 'another-organization', 'viewer-organization'])(
     'links to the viewer organization landing independently of workspace host %s',
     (organizationId) => {
-      organizationList.data = [{ id: 'viewer-organization' }]
-      render({ workspaces: WORKSPACES.map((workspace) => ({ ...workspace, organizationId })) })
-      expect(document.querySelector('a[href="/o"]')).toHaveTextContent('Back to organization')
-      expect(document.querySelector('a[href^="/o/"]')).toBeNull()
+      render({
+        organizationHref: '/o/viewer-organization/home',
+        workspaces: WORKSPACES.map((workspace) => ({ ...workspace, organizationId })),
+      })
+      expect(document.querySelector('a[href="/o/viewer-organization/home"]')).toHaveTextContent(
+        'Back to organization'
+      )
     }
   )
 
-  it.each([[], undefined])(
-    'hides organization navigation without loaded memberships: %j',
-    (data) => {
-      organizationList.data = data
-      render()
-      expect(document.body).not.toHaveTextContent('Back to organization')
-    }
-  )
+  it('hides organization navigation without an eligible destination', () => {
+    render({ organizationHref: null })
+    expect(document.body).not.toHaveTextContent('Back to organization')
+  })
 
   it('keeps settings in the profile menu instead of duplicating it in the switcher', () => {
     render()

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx

@@ -48,7 +48,6 @@ import {
   type WorkspaceCreationPolicy,
   workspaceKeys,
 } from '@/hooks/queries/workspace'
-import { useOrganizationNavigationHref } from '@/hooks/use-organization-navigation'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useSettingsNavigation } from '@/hooks/use-settings-navigation'
 
@@ -78,6 +77,7 @@ function DisabledReasonTooltip({ reason, children }: DisabledReasonTooltipProps)
 }
 
 interface WorkspaceHeaderProps {
+  organizationHref: string | null
   /** The active workspace object */
   activeWorkspace?: { name: string } | null
   /** Current workspace ID */
@@ -126,6 +126,7 @@ interface WorkspaceHeaderProps {
  * Workspace header component that displays workspace name and switcher.
  */
 function WorkspaceHeaderImpl({
+  organizationHref,
   activeWorkspace,
   workspaceId,
   workspaces,
@@ -272,7 +273,6 @@ function WorkspaceHeaderImpl({
 
   const { navigateToSettings } = useSettingsNavigation()
   const queryClient = useQueryClient()
-  const organizationHref = useOrganizationNavigationHref()
 
   const activeWorkspaceFull = workspaces.find((w) => w.id === workspaceId) || null
   const isWorkspaceReady = !isWorkspacesLoading && activeWorkspaceFull !== null

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

@@ -136,7 +136,6 @@ import { useUpdateWorkflow } from '@/hooks/queries/workflows'
 import type { Workspace } from '@/hooks/queries/workspace'
 import { useContextMenu } from '@/hooks/use-context-menu'
 import { useMothershipChatEvents } from '@/hooks/use-mothership-chat-events'
-import { useOrganizationNavigationHref } from '@/hooks/use-organization-navigation'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useSettingsNavigation } from '@/hooks/use-settings-navigation'
 import { useFolderStore } from '@/stores/folders/store'
@@ -333,6 +332,10 @@ const HIDDEN_STYLE = { display: 'none' } as const
  */
 const DRAG_EXEMPT_CLASS = '[-webkit-app-region:no-drag]'
 
+interface SidebarProps {
+  organizationHref: string | null
+}
+
 /**
  * Sidebar component with resizable width that persists across page refreshes.
  *
@@ -349,7 +352,7 @@ const DRAG_EXEMPT_CLASS = '[-webkit-app-region:no-drag]'
  *
  * @returns Sidebar with workflows panel
  */
-export const Sidebar = memo(function Sidebar() {
+export const Sidebar = memo(function Sidebar({ organizationHref }: SidebarProps) {
   const { isCollapsed: isCollapsedProp, isPeeking } = useSidebarChrome()
   const isCollapsed = isCollapsedProp && !isPeeking
   const params = useParams()
@@ -820,7 +823,6 @@ export const Sidebar = memo(function Sidebar() {
       onNavigate: () => handleOpenSettings(id),
     }))
 
-  const organizationHref = useOrganizationNavigationHref()
   if (organizationHref) {
     profileNavigationLinks.push({
       label: 'Organization',
@@ -1305,6 +1307,7 @@ export const Sidebar = memo(function Sidebar() {
               )}
             >
               <WorkspaceHeader
+                organizationHref={organizationHref}
                 activeWorkspace={activeWorkspace ?? routeWorkspace}
                 workspaceId={workspaceId}
                 workspaces={workspaces}

apps/sim/hooks/use-organization-navigation.ts

@@ -23,7 +23,7 @@ export const WORKSPACES_PATH = '/workspace'
 export const WORKSPACE_SETTINGS_PATH = `${WORKSPACES_PATH}?redirect=settings`
 
 /** Root of the organization surface; `/o` alone resolves like {@link APP_ENTRY_PATH}. */
-export const ORGANIZATIONS_PATH = '/o'
+const ORGANIZATIONS_PATH = '/o'
 
 /**
  * Every destination under one organization's surface, built from one place so the

apps/sim/lib/navigation/paths.ts

@@ -16,7 +16,10 @@ vi.mock('@/lib/organizations/surface', () => ({
   resolveOrganizationLanding: mockResolveOrganizationLanding,
 }))
 
-import { resolveAppEntryPath } from '@/lib/navigation/resolve-app-entry'
+import {
+  resolveAppEntryPath,
+  resolveOrganizationEntryPath,
+} from '@/lib/navigation/resolve-app-entry'
 
 describe('resolveAppEntryPath', () => {
   beforeEach(() => {
@@ -51,3 +54,50 @@ describe('resolveAppEntryPath', () => {
     expect(mockSearchAvailable).not.toHaveBeenCalled()
   })
 })
+
+describe('resolveOrganizationEntryPath', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockSearchAvailable.mockResolvedValue(true)
+  })
+
+  it('uses the authenticated viewer membership independently of the workspace host', async () => {
+    mockResolveOrganizationLanding.mockResolvedValue('viewer-organization')
+    const session = {
+      user: { id: 'viewer' },
+      session: { activeOrganizationId: 'viewer-organization' },
+    }
+
+    await expect(resolveOrganizationEntryPath(session)).resolves.toBe('/o/viewer-organization/home')
+    expect(mockResolveOrganizationLanding).toHaveBeenCalledWith('viewer', 'viewer-organization')
+    expect(mockSearchAvailable).toHaveBeenCalledWith({ organizationId: 'viewer-organization' })
+  })
+
+  it('returns no organization destination for a nonmember with a stale active organization', async () => {
+    mockResolveOrganizationLanding.mockResolvedValue(null)
+    const session = {
+      user: { id: 'viewer' },
+      session: { activeOrganizationId: 'former-organization' },
+    }
+
+    await expect(resolveOrganizationEntryPath(session)).resolves.toBeNull()
+    expect(mockResolveOrganizationLanding).toHaveBeenCalledWith('viewer', 'former-organization')
+    expect(mockSearchAvailable).not.toHaveBeenCalled()
+  })
+
+  it('returns no organization destination when the member organization has Search disabled', async () => {
+    mockResolveOrganizationLanding.mockResolvedValue('viewer-organization')
+    mockSearchAvailable.mockResolvedValue(false)
+
+    await expect(resolveOrganizationEntryPath({ user: { id: 'viewer' } })).resolves.toBeNull()
+  })
+
+  it('propagates membership lookup failures', async () => {
+    mockResolveOrganizationLanding.mockRejectedValue(new Error('Membership lookup failed'))
+
+    await expect(resolveOrganizationEntryPath({ user: { id: 'viewer' } })).rejects.toThrow(
+      'Membership lookup failed'
+    )
+    expect(mockSearchAvailable).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/navigation/resolve-app-entry.test.ts

@@ -7,6 +7,18 @@ interface EntrySession {
   user: { id: string }
 }
 
+/** Returns a destination only after checking the viewer's membership and organization rollout. */
+export async function resolveOrganizationEntryPath(session: EntrySession): Promise<string | null> {
+  const organizationId = await resolveOrganizationLanding(
+    session.user.id,
+    getActiveOrganizationId(session)
+  )
+  if (!organizationId) return null
+  return (await isKnowledgeMemberAccessAvailable({ organizationId }))
+    ? organizationRoutes(organizationId).home
+    : null
+}
+
 /**
  * Routes organization members to Home when the organization surface is enabled for
  * them. Everyone else — viewers without an organization, and members whose
@@ -16,12 +28,5 @@ interface EntrySession {
  * settings must not be dropped into them.
  */
 export async function resolveAppEntryPath(session: EntrySession): Promise<string> {
-  const organizationId = await resolveOrganizationLanding(
-    session.user.id,
-    getActiveOrganizationId(session)
-  )
-  if (!organizationId) return WORKSPACES_PATH
-  return (await isKnowledgeMemberAccessAvailable({ organizationId }))
-    ? organizationRoutes(organizationId).home
-    : WORKSPACES_PATH
+  return (await resolveOrganizationEntryPath(session)) ?? WORKSPACES_PATH
 }