feat: auto-join scoped Feishu OAuth users

hub/src/admin/routes/authRoutes.ts

@@ -5,7 +5,7 @@ import { randomBytes } from "node:crypto";
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { resolveActiveFeishuApplication } from "../../connections/feishuApplicationConnections.js";
-import { upsertScopedFeishuIdentity } from "../../feishu/identityNamespace.js";
+import { upsertScopedFeishuIdentityInTransaction } from "../../feishu/identityNamespace.js";
 import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import {
   buildAuthorizeUrl,
@@ -164,16 +164,54 @@ export async function registerAuthRoutes(app: FastifyInstance, config: AuthRoute
       const feishuUser = await exchangeCodeForUser(oauthConfig, code);
       let userId: string;
       if (statePayload.connectionId !== undefined && statePayload.organizationId !== undefined) {
-        const identity = await upsertScopedFeishuIdentity(config.prisma, {
-          connectionId: statePayload.connectionId,
-          openId: feishuUser.openId,
-          ...(feishuUser.unionId !== undefined ? { unionId: feishuUser.unionId } : {}),
-          displayName: feishuUser.displayName,
-          ...(feishuUser.avatarUrl !== null ? { avatarUrl: feishuUser.avatarUrl } : {}),
+        const connectionId = statePayload.connectionId;
+        const organizationId = statePayload.organizationId;
+        const identity = await config.prisma.$transaction(async (tx) => {
+          const resolved = await upsertScopedFeishuIdentityInTransaction(tx, {
+            connectionId,
+            expectedOrganizationId: organizationId,
+            openId: feishuUser.openId,
+            ...(feishuUser.unionId !== undefined ? { unionId: feishuUser.unionId } : {}),
+            displayName: feishuUser.displayName,
+            ...(feishuUser.avatarUrl !== null ? { avatarUrl: feishuUser.avatarUrl } : {}),
+          });
+          const activeMembership = await tx.organizationMembership.findFirst({
+            where: {
+              organizationId,
+              userId: resolved.userId,
+              revokedAt: null,
+            },
+            select: { id: true },
+          });
+          if (activeMembership === null) {
+            const revokedMembership = await tx.organizationMembership.findFirst({
+              where: {
+                organizationId,
+                userId: resolved.userId,
+                revokedAt: { not: null },
+              },
+              select: { id: true },
+            });
+            if (revokedMembership === null) {
+              await tx.organizationMembership.create({
+                data: {
+                  organizationId,
+                  userId: resolved.userId,
+                  role: "MEMBER",
+                },
+              });
+              await tx.auditEntry.create({
+                data: {
+                  organizationId,
+                  actorUserId: resolved.userId,
+                  action: "organization_member.oauth_auto_joined",
+                  metadata: { connectionId: resolved.connectionId, role: "MEMBER" },
+                },
+              });
+            }
+          }
+          return resolved;
         });
-        if (identity.organizationId !== statePayload.organizationId) {
-          throw new HttpError(400, "bad_request", "OAuth identity Organization scope mismatch");
-        }
         userId = identity.userId;
         setSessionCookie(reply, config, {
           userId,