fix: scope getOrganization lookup to the authenticated session

[nicknisi]

Summary

getOrganizationAction resolved a client-supplied organizationId using the app's WorkOS API key without checking that the caller's session was authenticated within that organization. Because the API key can read any organization in the environment, a caller could resolve an arbitrary organization's id/name by ID.

This scopes the lookup to the current session: it returns null unless the caller is authenticated and the requested organizationId matches the session's organization.

Behavior-preserving

The only consumer is the impersonation banner (src/client/components/impersonation.tsx), which always passes the organization id from the caller's own session (useAuth()). Legitimate usage is unchanged; only cross-organization lookups — never an intended capability — now return null.

Tests

• denies fetching an organization the caller is not authenticated within (WorkOS client not called)
• returns null when there is no authenticated session
• existing success / not-found paths updated to supply a session

Full test suite green (236 tests); oxlint and build clean.

SemVer

Patch. The public getOrganizationAction signature is unchanged (OrganizationInfo | null) — callers already had to handle null.

[devin-ai-integration]

Devin Review found 0 potential issues.

[greptile-apps]

Greptile Summary

This PR scopes organization lookup to the caller’s authenticated session. The main changes are:

• Adds a session-org check before calling the WorkOS organization API.
• Returns null for unauthenticated or cross-organization requests.
• Updates action tests for authorized, unauthorized, unauthenticated, and not-found paths.

Confidence Score: 4/5

The change is narrowly scoped and covered by tests for authorized, unauthorized, unauthenticated, and not-found organization lookup paths.

The implementation preserves the public action contract while preventing cross-organization lookups, and the tests exercise the relevant behavior boundaries described by the change.

T-Rex Logs

What T-Rex did

• Ran baseline tests to establish initial behavior across same-session, cross-org, unauthenticated, and authorized-not-found scenarios.
• Ran the head-branch tests to compare against the baseline and verify updated cross-org and unauthenticated behavior while confirming same-session and authorized-not-found results.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix: scope getOrganization lookup to the..." | Re-trigger Greptile}