Improve org access control and API response filtering (#8)

* Fix admin auth bypass: enforce GitHub org-admin checks in all environments

Previously, authorizeOrgAccess() skipped all admin authorization in
non-production environments, allowing any authenticated user to perform
admin actions (update CLAs, toggle activation, manage bypass lists) and
read admin panel data for any organization.

Changes:
- Remove blanket NODE_ENV !== "production" bypass from authorizeOrgAccess
- Add scoped DB-admin fallback for non-production (only the designated
  installer passes, not any authenticated user), consistent with
  filterInstalledOrganizationsForAdmin
- Restrict GET /api/sign/[orgSlug] to return only signing-relevant org
  fields (name, slug, avatar, isActive, claText) instead of the full
  org row which leaked adminUserId, installationId, etc.
- Remove installedOrgsCount from GET /api/orgs response to prevent
  leaking total platform org count to non-admin users

https://claude.ai/code/session_01FxG73b4jTBhGa5CK6kyKrG

* Scope installedOrgsCount to user's authorized orgs

Return the count of orgs the user is admin of rather than removing
the field entirely, so the client can distinguish "no orgs installed"
from "installed but no admin access".

https://claude.ai/code/session_01FxG73b4jTBhGa5CK6kyKrG

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: callicles

app/api/orgs/route.ts

@@ -41,7 +41,7 @@ export async function GET() {
     return NextResponse.json({
       orgs,
       user: toSessionUserDto(user),
-      installedOrgsCount: installedOrgs.length,
+      installedOrgsCount: orgs.length,
     })
   } catch (err) {
     console.error("Failed to list authorized organizations:", err)

app/api/sign/[orgSlug]/route.ts

@@ -28,7 +28,10 @@ export async function GET(
 
   return NextResponse.json({
     org: {
-      ...org,
+      name: org.name,
+      githubOrgSlug: org.githubOrgSlug,
+      avatarUrl: org.avatarUrl,
+      isActive: org.isActive,
       claMarkdown: org.claText,
     },
     user: toSessionUserDto(user),

lib/server/org-access.ts

@@ -35,17 +35,21 @@ export async function authorizeOrgAccess(orgSlug: string): Promise<OrgAccessResu
     }
   }
 
-  if (process.env.NODE_ENV !== "production") {
-    return { ok: true, org, user }
-  }
-
   try {
     const isAdmin = await isGitHubInstallationAccountAdmin(user, org)
     if (!isAdmin) {
-      return {
-        ok: false,
-        status: 403,
-        message: "Forbidden: GitHub installation admin access required",
+      // In non-production, when no GitHub OAuth token is available for org-admin
+      // checks, fall back to the DB admin mapping — consistent with
+      // filterInstalledOrganizationsForAdmin. This is strictly scoped: only the
+      // designated admin (who installed the app) passes, not any authenticated user.
+      const hasDbAdminFallback =
+        process.env.NODE_ENV !== "production" && org.adminUserId === user.id
+      if (!hasDbAdminFallback) {
+        return {
+          ok: false,
+          status: 403,
+          message: "Forbidden: GitHub installation admin access required",
+        }
       }
     }
   } catch (error) {