Merge test to main

[sweetmantech]

Merge test branch changes to main

Summary by CodeRabbit

• New Features
  • Added optional organization ID parameter to chat requests for enhanced multi-organization support
  • Implemented access validation to ensure users can only submit chat requests for organizations they belong to, returning an error if access is denied

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
recoup-api	Building	Preview	Jan 16, 2026 1:58am

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

A new organization access validation module is introduced to verify that accounts have access to specified organizations. This validation is integrated into chat request handling via an optional organizationId parameter, with comprehensive test coverage added across validation and chat test suites.

Changes

Cohort / File(s)	Summary
Organization Access Validation Module lib/organizations/validateOrganizationAccess.ts	New module exporting ValidateOrganizationAccessParams interface and validateOrganizationAccess() async function that validates account membership via direct ownership check or getAccountOrganizations() query.
Organization Access Validation Tests lib/organizations/__tests__/validateOrganizationAccess.test.ts	Unit test suite covering ownership validation, membership checks via mocked getAccountOrganizations, and input validation edge cases (empty IDs).
Chat Request Validation lib/chat/validateChatRequest.ts	Adds optional organizationId to request schema; imports and invokes validateOrganizationAccess to verify access, returning 403 on denial or setting orgId on success.
Chat Validation Tests lib/chat/__tests__/validateChatRequest.test.ts	Introduces organizationId override test group validating schema acceptance, member verification for bearer token and API key auth, override behavior, rejection for non-members, and fallback scenarios.
Chat Handler Test Mocks lib/chat/__tests__/handleChatGenerate.test.ts, lib/chat/__tests__/handleChatStream.test.ts, lib/chat/__tests__/integration/chatEndToEnd.test.ts	Each adds mock for validateOrganizationAccess to test scaffolding for organization access control.

Sequence Diagram

sequenceDiagram
    participant Client
    participant ValidateChatRequest as Chat Request Validator
    participant ValidateOrgAccess as Organization Access Validator
    participant Database as Membership DB
    
    Client->>ValidateChatRequest: POST chat request (with organizationId)
    activate ValidateChatRequest
    ValidateChatRequest->>ValidateOrgAccess: validateOrganizationAccess(accountId, organizationId)
    activate ValidateOrgAccess
    
    alt Direct Ownership
        ValidateOrgAccess->>ValidateOrgAccess: Check if accountId equals organizationId
        ValidateOrgAccess-->>ValidateChatRequest: return true
    else Membership Check
        ValidateOrgAccess->>Database: getAccountOrganizations(accountId, organizationId)
        activate Database
        Database-->>ValidateOrgAccess: return memberships array
        deactivate Database
        ValidateOrgAccess->>ValidateOrgAccess: Check if non-empty
        ValidateOrgAccess-->>ValidateChatRequest: return boolean
    end
    
    deactivate ValidateOrgAccess
    
    alt Access Granted
        ValidateChatRequest->>ValidateChatRequest: Set orgId to organizationId
        ValidateChatRequest-->>Client: Continue chat validation
    else Access Denied
        ValidateChatRequest-->>Client: 403 Forbidden
    end
    deactivate ValidateChatRequest

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• Test #69: Modifies getAccountOrganizations utility that is directly invoked by the new validateOrganizationAccess function for membership validation.
• feat: add RECOUP_ORG_ID constant for accountId override #109: Introduces related canAccessAccount organization-access check in lib/organizations using the same getAccountOrganizations dependency.

Poem

🐰 A rabbit hops through org gates with care,
Checking if your access is truly there,
No shortcuts taken, each member verified,
Chat flows safely, properly authorized!
Hop-hop-validate, that's the way! ✨

✨ Finishing touches

• 📝 Generate docstrings

---

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 15f29a1 and abe9c7f.

📒 Files selected for processing (7)

• lib/chat/__tests__/handleChatGenerate.test.ts
• lib/chat/__tests__/handleChatStream.test.ts
• lib/chat/__tests__/integration/chatEndToEnd.test.ts
• lib/chat/__tests__/validateChatRequest.test.ts
• lib/chat/validateChatRequest.ts
• lib/organizations/__tests__/validateOrganizationAccess.test.ts
• lib/organizations/validateOrganizationAccess.ts

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}