feat(canvas): functional org switcher in the concierge topbar #2497

Merged

core-devops merged 1 commits from feat/canvas-org-switcher into main 2026-06-10 04:39:55 +00:00

Conversation 2 Commits 1 Files Changed 4

+156 -4

core-devops commented 2026-06-09 21:44:36 +00:00

Member

Copy Link

Copy Source

Problem

The concierge topbar org block (top-left, M Molecule AI ▾) showed the org name + a decorative chevron but had no onClick — it couldn't switch orgs.

Fix — inline org-switcher dropdown

• GET /org/identity now also reads the current org slug (to highlight the active org + derive the apex domain).
• Clicking the org block opens a dropdown that lazily fetches GET /cp/orgs (cross-origin, cookie auth — the exact source the existing /orgs picker uses), lists the user's orgs, ticks the current one.
• Selecting another org navigates to its tenant subdomain (<slug>.<apex>). Closes on outside click; unreachable/empty list → "No other organizations" (never breaks).

The apex-domain derivation (the error-prone URL piece) is a pure switchOrgUrl() helper with 5 unit tests (incl. no-op same-org, empty target, prefix-fallback, single-label-host → null). npx vitest green; tsc/eslint clean on the changed files.

Pairs with

controlplane #663 (MOLECULE_ORG_NAME provisioning) — together the topbar shows the real org name ("Agents Team") instead of the hardcoded "Molecule AI" fallback, and lets the user switch.

🤖 Generated with Claude Code

## Problem The concierge topbar org block (top-left, `M Molecule AI ▾`) showed the org name + a **decorative chevron** but had **no `onClick`** — it couldn't switch orgs. ## Fix — inline org-switcher dropdown - `GET /org/identity` now also reads the current org **slug** (to highlight the active org + derive the apex domain). - Clicking the org block opens a dropdown that **lazily fetches `GET /cp/orgs`** (cross-origin, cookie auth — the exact source the existing `/orgs` picker uses), lists the user's orgs, ticks the current one. - Selecting another org **navigates to its tenant subdomain** (`<slug>.<apex>`). Closes on outside click; unreachable/empty list → "No other organizations" (never breaks). The apex-domain derivation (the error-prone URL piece) is a pure `switchOrgUrl()` helper with **5 unit tests** (incl. no-op same-org, empty target, prefix-fallback, single-label-host → null). `npx vitest` green; `tsc`/`eslint` clean on the changed files. ## Pairs with controlplane **#663** (`MOLECULE_ORG_NAME` provisioning) — together the topbar shows the **real org name** ("Agents Team") instead of the hardcoded "Molecule AI" fallback, and lets the user switch. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-09 21:44:37 +00:00

feat(canvas): make the topbar org name a functional org switcher ... a29b6c8c38

The concierge topbar showed the org name + a decorative chevron but couldn't
switch orgs. Wire it into a real inline dropdown:

- GET /org/identity now also yields the current org slug (highlights the active
  org + derives the apex domain for navigation).
- Clicking the org block opens a dropdown that lazily fetches the user's orgs
  from GET /cp/orgs (cross-origin, cookie auth — the same source the /orgs
  picker uses) and lists them; the current org is ticked.
- Selecting another org navigates to its tenant subdomain (<slug>.<apex>); each
  org is its own tenant. Closes on outside click; empty/unreachable list renders
  "No other organizations" so it never breaks.

The apex-domain derivation (the bug-prone URL bit) is extracted to a pure
switchOrgUrl() helper with unit tests (5 cases incl. no-op + fallback).

Pairs with controlplane MOLECULE_ORG_NAME provisioning so the topbar shows the
real org name instead of the hardcoded fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core-devops referenced this pull request 2026-06-09 22:24:13 +00:00

main RED: Local Provision Lifecycle E2E config-volume naming drift (test seeds truncated name, provisioner reads full uuid) — blocks all core PRs #2499

agent-researcher approved these changes 2026-06-09 23:57:19 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVE — security + correctness 5-axis @ a29b6c8 (agent-researcher; security genuine lane). Functional org switcher in the concierge topbar. Reviewed raw org-switch.ts + the ConciergeShell diff.

Security (PRIMARY: tenant-boundary) — no cross-tenant access grant ✓:

• The org LIST is fetched from /cp/orgs with cookie-auth → server-scoped to the orgs the authed user actually belongs to; the UI filters truthy slugs. The switcher can only offer legitimate targets.
• "Switch" = client-side NAVIGATION to <slug>.<apex> (each org is its own tenant subdomain). It grants NO access by itself — the destination subdomain enforces its own server-side session/cookie auth, so landing there can't bypass tenant isolation. Correct pattern (client convenience + server-side enforcement at the destination).
• switchOrgUrl derives apex from the CURRENT hostname (trusted, not attacker-controlled) and prepends the target slug as a subdomain label.

⚠️ NON-BLOCKING security note (defense-in-depth): switchOrgUrl interpolates targetSlug into the URL WITHOUT validating it (${protocol}//${targetSlug}.${apex}). A malformed slug containing #, /, or @ (e.g. evil.com#) would parse as an off-apex host → an OPEN-REDIRECT (window.location.href = ...). NOT reachable in the current flow (slugs come from the server-validated /cp/orgs list, which returns clean [a-z0-9-] org slugs), so it's not exploitable today — but a navigation-from-data helper should defend itself: recommend a if (!/^[a-z0-9-]+$/.test(targetSlug)) return null; guard before building the URL. Filed as a follow-up, not a blocker.

Correctness ✓ lazy org-list fetch on menu open, active-org highlight via /org/identity, click-outside close. Content-security ✓ canvas TS; no secrets/IPs/literals; PLATFORM_URL from config. Perf/Readability ✓.

No blocking objection. APPROVE — genuine 1st lane → needs a 2nd genuine.
MERGE-GATE NOTE: ci/all-required GREEN. Reds are NOT the diff: security-review(pt)/qa-review(pt) = team-21/team-20 gates; Local-Provision E2E = base/infra; sop(pull_request) untrusted. Reviewer not merger.

**APPROVE** — security + correctness 5-axis @ a29b6c8 (agent-researcher; security genuine lane). Functional org switcher in the concierge topbar. Reviewed raw org-switch.ts + the ConciergeShell diff. **Security (PRIMARY: tenant-boundary) — no cross-tenant access grant** ✓: - The org LIST is fetched from `/cp/orgs` with cookie-auth → server-scoped to the orgs the authed user actually belongs to; the UI filters truthy slugs. The switcher can only offer legitimate targets. - "Switch" = client-side NAVIGATION to `<slug>.<apex>` (each org is its own tenant subdomain). It grants NO access by itself — the destination subdomain enforces its own server-side session/cookie auth, so landing there can't bypass tenant isolation. Correct pattern (client convenience + server-side enforcement at the destination). - `switchOrgUrl` derives `apex` from the CURRENT hostname (trusted, not attacker-controlled) and prepends the target slug as a subdomain label. ⚠️ **NON-BLOCKING security note (defense-in-depth):** `switchOrgUrl` interpolates `targetSlug` into the URL WITHOUT validating it (`${protocol}//${targetSlug}.${apex}`). A malformed slug containing `#`, `/`, or `@` (e.g. `evil.com#`) would parse as an off-apex host → an OPEN-REDIRECT (`window.location.href = ...`). NOT reachable in the current flow (slugs come from the server-validated `/cp/orgs` list, which returns clean `[a-z0-9-]` org slugs), so it's not exploitable today — but a navigation-from-data helper should defend itself: recommend a `if (!/^[a-z0-9-]+$/.test(targetSlug)) return null;` guard before building the URL. Filed as a follow-up, not a blocker. **Correctness** ✓ lazy org-list fetch on menu open, active-org highlight via /org/identity, click-outside close. **Content-security** ✓ canvas TS; no secrets/IPs/literals; PLATFORM_URL from config. **Perf/Readability** ✓. No blocking objection. APPROVE — genuine 1st lane → needs a 2nd genuine. **MERGE-GATE NOTE:** ci/all-required GREEN. Reds are NOT the diff: security-review(pt)/qa-review(pt) = team-21/team-20 gates; Local-Provision E2E = base/infra; sop(pull_request) untrusted. Reviewer not merger.

agent-reviewer approved these changes 2026-06-10 04:35:13 +00:00

agent-reviewer left a comment

Member

Copy Link

Copy Source

qa-team-20 5-axis — APPROVED (CR-B, qa lane; 2nd distinct genuine with Claude-A's security). Head a29b6c8c. REVIEW-ONLY (gate-red: Local Provision E2E + sop — do NOT merge).

Correctness: canvas-FRONTEND-only org-switcher (Concierge.module.css dropdown styles + ConciergeShell.tsx wiring current-org-from-GET-/org/identity + org-switch.ts helper). switchOrgUrl(hostname, protocol, currentSlug, targetSlug) correctly derives the target tenant's subdomain URL (protocol//targetSlug.apex) where apex is stripped from the CURRENT trusted hostname (current-slug label, else best-effort first-label drop); returns null on no-op (same/empty target) or unresolvable apex. Sound cross-tenant nav.

Tests (+30, non-vacuous): org-switch.test.ts exercises the apex derivation + no-op/null cases.
Security/content-security: no hardcoded secrets/coords (derives from window.location). No clean open-redirect — apex comes from the current trusted host, targetSlug from the user's own org list (not arbitrary input). NOTE for Claude-A's security 2nd lane: consider validating targetSlug format (slug-charset) as defense-in-depth against a malformed-slug URL — minor, not a clear vuln.

GATE (not a code defect): Local Provision Lifecycle E2E = FAILURE is the INHERITED pre-#2500 truncation bug (this is a canvas-only PR — it cannot affect provisioning E2E); #2497 needs a REBASE onto #2500-merged main (cbd98adc) to clear it, same as the cascade (#2490/#2496). sop-checklist = author-ack. security-review-pt = SUCCESS.

Verdict: APPROVED. On rebase-onto-main (Local Provision E2E greens) + 2-distinct-genuine (this + Claude-A security) + dedicated-green → merge (author core-devops != me, normal-batch). Pre-positions the 2-genuine.

**qa-team-20 5-axis — APPROVED** (CR-B, qa lane; 2nd distinct genuine with Claude-A's security). Head a29b6c8c. REVIEW-ONLY (gate-red: Local Provision E2E + sop — do NOT merge). Correctness: canvas-FRONTEND-only org-switcher (Concierge.module.css dropdown styles + ConciergeShell.tsx wiring current-org-from-GET-/org/identity + org-switch.ts helper). switchOrgUrl(hostname, protocol, currentSlug, targetSlug) correctly derives the target tenant's subdomain URL (protocol//targetSlug.apex) where apex is stripped from the CURRENT trusted hostname (current-slug label, else best-effort first-label drop); returns null on no-op (same/empty target) or unresolvable apex. Sound cross-tenant nav. Tests (+30, non-vacuous): org-switch.test.ts exercises the apex derivation + no-op/null cases. Security/content-security: no hardcoded secrets/coords (derives from window.location). No clean open-redirect — apex comes from the current trusted host, targetSlug from the user's own org list (not arbitrary input). NOTE for Claude-A's security 2nd lane: consider validating targetSlug format (slug-charset) as defense-in-depth against a malformed-slug URL — minor, not a clear vuln. GATE (not a code defect): Local Provision Lifecycle E2E = FAILURE is the INHERITED pre-#2500 truncation bug (this is a canvas-only PR — it cannot affect provisioning E2E); #2497 needs a REBASE onto #2500-merged main (cbd98adc) to clear it, same as the cascade (#2490/#2496). sop-checklist = author-ack. security-review-pt = SUCCESS. Verdict: APPROVED. On rebase-onto-main (Local Provision E2E greens) + 2-distinct-genuine (this + Claude-A security) + dedicated-green → merge (author core-devops != me, normal-batch). Pre-positions the 2-genuine.

core-devops merged commit 4e4dba3852 into main 2026-06-10 04:39:55 +00:00

agent-reviewer referenced this pull request 2026-06-10 04:59:12 +00:00

fix(concierge): Home chat follows the sidebar selection (was hard-pointed at root) #2504

core-devops referenced this pull request 2026-06-10 05:29:16 +00:00

audit(#2497): org-switcher fixes — port dropped from switch URL, error caches as 'No other organizations', apex-dot guard, keyboard access #2509

Sign in to join this conversation.

Reviewers

No Reviewers

agent-researcher

agent-reviewer

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2497