Improve organization authorization and Prisma scoping: transactional invariants and recovery

[DevALVIN-24]

closes #1542

Description

This PR addresses security risks and state management vulnerabilities in organization-scoped queries and mutations by introducing robust tenant isolation boundaries using Prisma client extensions, correcting authorization middleware table lookups, and enforcing deterministic transactional boundaries for saved searches.

Key Changes

1. Prisma Scoping & Tenant Isolation (src/lib/prismaScope.ts, src/lib/prisma.ts):

   • Extended the request-scoped PrismaScope with orgId.
   • Built a global Prisma $extends query extension that intercepts queries on all organization-scoped models (Vault, Team, Membership, AnalyticsReport, AnalyticsReportQuota, OrgVaultSearch).
   • Automatically asserts that the active orgId matches query parameters, preventing cross-tenant data exposure at the database driver level.

2. Middleware Table Corrections & Scoping (src/middleware/orgAuth.ts):

   • Fixed production authorization bugs where middleware was querying non-existent tables (org_members, team_members) instead of memberships.
   • Migrated all middleware queries to the Prisma client (getPrisma()).
   • Dynamically binds the authorized organization's ID to prismaStorage so it automatically scopes downstream queries.

3. Atomic Operations & Idempotency (src/routes/orgVaults.ts):

   • Converted all router queries to type-safe Prisma client operations.
   • Enforced the MAX_SEARCHES_PER_ORG constraint inside a database transaction with Serializable isolation level to prevent race conditions during concurrent creations.
   • Implemented standard idempotency logic via idempotency-key request headers to prevent duplicate submissions and safely recover state upon transaction failures.

4. Robust Automated Testing (src/tests/orgVaults.prismaScope.test.ts):

   • Added focused tests validating organization scoping boundaries, transactional limit enforcement, idempotency key checks, and recovery paths.

---

Verification Results

Successfully verified all organization authorization, database error handling, and scoping tests:

node --experimental-vm-modules node_modules/jest/bin/jest.js --forceExit src/tests/orgAuth.test.ts src/tests/orgAuth.dbErrors.test.ts src/tests/orgVaults.prismaScope.test.ts

Output:

PASS src/tests/orgAuth.test.ts
PASS src/tests/orgVaults.prismaScope.test.ts
PASS src/tests/orgAuth.dbErrors.test.ts

Test Suites: 3 passed, 3 total
Tests:       16 passed, 16 total
Snapshots:   0 total
Time:        7.36 s

---

Design Tradeoffs & Limitations

• Hybrid Knex/Prisma Compilation: Knex is retained as a dynamic SQL builder for complex Full-Text-Search queries (e.g. /:orgId/vaults/search). However, the compiled SQL is executed directly through the scoped Prisma client (getPrisma().$queryRawUnsafe(...)) to ensure it executes within the active transactional session.

[drips-wave]

@DevALVIN-24 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits