fix(web): unrecognized org roles fail closed, and the package testsuite learns canWrite

Two Criticals from review:

1. Fail-open: resolveScope's org branch gated the ACL check on
   hasOrgAccess (prefix match only, "org:<accountId>:") but derived
   canWrite from orgRole (which validates the role suffix against
   ORG_ROLES). A claim with an unrecognized role, e.g.
   "org:acc-7:contractor", passed hasOrgAccess, made orgRole return
   null, and null !== "member" evaluated to true — an unparseable role
   got write access. Fixed by resolving the role once and gating on
   role === null (thrown as the same "forbidden" WorkspaceAuthError),
   so an unrecognized role loses read too, not just write. canWrite is
   now literally role !== "member" over a role proven non-null.
   hasOrgAccess is no longer imported into context.ts (still exported
   and independently tested in session.ts).

2. CI break: making WorkspaceScope.canWrite required broke
   `pnpm --filter @netizen-labs/workspace typecheck` — 15 TS2741/
   TS2345 errors across the package's own test suite, which builds
   scope literals directly. Added canWrite to every one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: MaxBrych

apps/web/src/lib/workspace/context.ts

@@ -13,7 +13,6 @@ import { fetchUserinfo, groupsFrom, refreshTokens } from "./oidc";
 import { createSessionStore } from "./session-store";
 import {
   ORG_ROLES,
-  hasOrgAccess,
   isCitizenSession,
   isExpired,
   orgGroupId,
@@ -122,7 +121,18 @@ export async function resolveScope(params: {
   if (!params.accountId) {
     throw new WorkspaceAuthError("forbidden", "an org scope needs an account id");
   }
-  if (!hasOrgAccess(params.session, params.accountId)) {
+  // Resolved once, and used as the sole gate: `orgRole` returns null both
+  // when there is no `org:<accountId>:*` claim at all AND when a claim is
+  // present but its role suffix is not one of ORG_ROLES (e.g. a stale or
+  // malformed "org:acc-7:contractor"). The former used to be caught by
+  // `hasOrgAccess`, which checks the prefix alone and does not validate the
+  // suffix — so an unrecognized role passed that gate, fell through to
+  // `orgRole(...) !== "member"`, and got `canWrite: true` from a role this
+  // codebase does not otherwise recognise. Gating on `role === null` instead
+  // fails closed for that case too: an unparseable role loses read access as
+  // well as write, deliberately, rather than defaulting to either.
+  const role = orgRole(params.session, params.accountId);
+  if (role === null) {
     throw new WorkspaceAuthError(
       "forbidden",
       `no group claim for org ${params.accountId}`,
@@ -134,9 +144,9 @@ export async function resolveScope(params: {
     accountId: params.accountId,
     folderName: orgFolderMount(params.accountId),
     // owner/admin write, member reads — the same mapping Task 11 applies to
-    // Nextcloud's own ACL. `hasOrgAccess` above already proved a claim
-    // exists, so `orgRole` cannot be null here.
-    canWrite: orgRole(params.session, params.accountId) !== "member",
+    // Nextcloud's own ACL. `role` is proven non-null above, so this is
+    // exactly an owner/admin allow-list.
+    canWrite: role !== "member",
   };
 }
 

apps/web/tests/workspace-context.test.ts

@@ -91,7 +91,24 @@ describe("resolveScope", () => {
     );
   });
 
-  // resolveScope delegates the ACL check to hasOrgAccess, so the same
+  // THE FAIL-OPEN REGRESSION: orgRole is the sole gate now, precisely because
+  // it validates the role suffix and a prefix-only check does not. A claim
+  // with a role outside ORG_ROLES must be refused entirely — not granted
+  // read via the old prefix check and then write via `role !== "member"`,
+  // which is what happened when resolveScope gated on hasOrgAccess (prefix
+  // only) and computed canWrite from orgRole (suffix-validating) separately:
+  // hasOrgAccess passed, orgRole returned null, and `null !== "member"` was
+  // true — an unrecognized role got write access.
+  it("refuses (not read, not write) a claim whose role is not in ORG_ROLES", async () => {
+    const contractor = { ...session, groups: ["org:acc-7:contractor"] };
+    await assert.rejects(
+      () => resolveScope({ session: contractor, scopeKind: "org", accountId: "acc-7", orgName: null }),
+      (err: unknown) => err instanceof WorkspaceAuthError && err.reason === "forbidden",
+    );
+  });
+
+  // resolveScope's org branch now gates on `orgRole` (which validates the
+  // role suffix, not just the "org:<accountId>:" prefix), so the same
   // trailing-colon property has to hold one layer up: a claim for org
   // "acc-70" must not unlock the scope for org "acc-7".
   it("refuses an org whose claim is a numeric prefix of the requested id (acc-70 claim vs acc-7 request)", async () => {

packages/workspace/test/nextcloud.test.ts

@@ -10,7 +10,7 @@ import {
 import type { WorkspaceScope } from "../src/types";
 
 const SUB = "0xabc";
-const scope: WorkspaceScope = { kind: "personal", sub: SUB };
+const scope: WorkspaceScope = { kind: "personal", sub: SUB, canWrite: true };
 
 const LISTING = `<?xml version="1.0"?>
 <d:multistatus xmlns:d="DAV:">

packages/workspace/test/propfind.test.ts

@@ -227,7 +227,7 @@ describe("parsePropfind", () => {
 // It did not: it decoded a second time, so a name containing "%" either threw
 // or resolved to a different file. These pin the round trip end to end.
 describe("propfind -> resolvePath round trip (the encoding contract)", () => {
-  const scope: WorkspaceScope = { kind: "personal", sub: "0xabc" };
+  const scope: WorkspaceScope = { kind: "personal", sub: "0xabc", canWrite: true };
 
   function listingOf(...encodedNames: string[]): string {
     const rows = encodedNames

packages/workspace/test/provenance.test.ts

@@ -13,6 +13,7 @@ const scope: WorkspaceScope = {
   sub: "0xabc",
   accountId: "acc-7",
   folderName: "Org Feuerwehr",
+  canWrite: true,
 };
 
 describe("buildAction", () => {
@@ -53,7 +54,7 @@ describe("buildAction", () => {
     const action = buildAction({
       actor: { kind: "human", sub: "0xabc" },
       kind: "delete",
-      scope: { kind: "personal", sub: "0xabc" },
+      scope: { kind: "personal", sub: "0xabc", canWrite: true },
       path: "alt.odt",
       now: new Date("2026-07-28T09:00:00Z"),
     });

packages/workspace/test/scope.test.ts

@@ -9,12 +9,13 @@ import {
 } from "../src/scope";
 
 const SUB = "0x1111111111111111111111111111111111111111";
-const personal: WorkspaceScope = { kind: "personal", sub: SUB };
+const personal: WorkspaceScope = { kind: "personal", sub: SUB, canWrite: true };
 const org: WorkspaceScope = {
   kind: "org",
   sub: SUB,
   accountId: "acc-7",
   folderName: "Org Feuerwehr",
+  canWrite: true,
 };
 
 describe("scopeRoot", () => {
@@ -31,7 +32,7 @@ describe("scopeRoot", () => {
 
   it("refuses an org scope with no folder name rather than falling back to the home", () => {
     assert.throws(
-      () => scopeRoot({ kind: "org", sub: SUB, accountId: "acc-7" }),
+      () => scopeRoot({ kind: "org", sub: SUB, accountId: "acc-7", canWrite: true }),
       ScopeViolationError,
     );
   });
@@ -153,7 +154,7 @@ describe("scopeRoot — component validation", () => {
   for (const badSub of badComponents) {
     it(`rejects a sub of ${JSON.stringify(badSub)}`, () => {
       assert.throws(
-        () => scopeRoot({ kind: "personal", sub: badSub }),
+        () => scopeRoot({ kind: "personal", sub: badSub, canWrite: true }),
         ScopeViolationError,
       );
     });
@@ -177,6 +178,7 @@ describe("scopeRoot — component validation", () => {
             sub: SUB,
             accountId: "acc-7",
             folderName: badFolderName,
+            canWrite: true,
           }),
         ScopeViolationError,
       );
@@ -193,7 +195,7 @@ describe("resolvePath — component validation", () => {
   for (const badSub of badComponents) {
     it(`rejects a sub of ${JSON.stringify(badSub)} before resolving any path`, () => {
       assert.throws(
-        () => resolvePath({ kind: "personal", sub: badSub }, "Dokumente/Antrag.odt"),
+        () => resolvePath({ kind: "personal", sub: badSub, canWrite: true }, "Dokumente/Antrag.odt"),
         ScopeViolationError,
       );
     });
@@ -203,7 +205,7 @@ describe("resolvePath — component validation", () => {
     assert.throws(
       () =>
         resolvePath(
-          { kind: "org", sub: SUB, accountId: "acc-7", folderName: ".." },
+          { kind: "org", sub: SUB, accountId: "acc-7", folderName: "..", canWrite: true },
           "Protokolle/2026.odt",
         ),
       ScopeViolationError,
@@ -219,6 +221,7 @@ describe("resolvePath — component validation", () => {
             sub: SUB,
             accountId: "acc-7",
             folderName: "../../other-citizen/Privat",
+            canWrite: true,
           },
           "steuer.odt",
         ),

packages/workspace/test/wopi.test.ts

@@ -16,7 +16,7 @@ import type { DirEntry } from "../src/propfind";
 import type { WorkspaceScope } from "../src/types";
 
 const SECRET = new Uint8Array(32).fill(7);
-const scope: WorkspaceScope = { kind: "personal", sub: "0xabc" };
+const scope: WorkspaceScope = { kind: "personal", sub: "0xabc", canWrite: true };
 const claims: WopiClaims = {
   sub: "0xabc",
   sessionId: "sess-1",
@@ -46,6 +46,7 @@ describe("file ids", () => {
       sub: "0xabc",
       accountId: "acct-1",
       folderName: "Org Feuerwehr",
+      canWrite: true,
     };
     const trickyPath = "Elternbeirat (Grundschule)/Bericht #1 Prüfbericht Müritz.odt";
     const decoded = decodeFileId(encodeFileId(orgScope, trickyPath));