Repository navigation
feat: choose and switch organisations for one person (1.5.0) - #13
Merged
Merged
Conversation
- ORG_REQUIRED now carries details.organizations: the organisations whose
account matched the email and password (named via the new optional
OrgStore.get), so clients can show a pick list.
- organizationsOf(userId): every active account with the same email.
- switchOrganization({ token, orgId, … }): moves a valid session to the same
person's account in another organisation without the password. The old
session ends, device binding applies as on refresh, and the switch is
audited in both organisations. New error code ORG_UNAVAILABLE.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018jBohk4otGVRjt3Y1cF1N2
BackStacked
added a commit
to mgpl-diagnostics/client
that referenced
this pull request
Nov 10, 2026
This mirrors the api's new fields for one person with accounts in
several labs.
## Changes
- **`auth.organizations()`** calls query `myOrganizations` and returns
`{ code, name, current }[]`.
- **`auth.switchOrganization(orgCode)`** calls mutation
`switchOrganization` with this device's signals and keeps the new tokens
in the session manager. Apps should reset their cached data afterwards.
- **`organizationChoices(error)`** returns the labs to pick from after
`ORG_REQUIRED` (`extensions.organizations`). It is exported from the
main and `/graphql` entries.
- **Types and docs.** Adds the `OrganizationChoice` type.
docs/graphql.md lists the new calls and `ORG_UNAVAILABLE`. llms-full.txt
is regenerated.
- **Version** is 1.5.0.
## Depends on
The api PR that adds `myOrganizations` / `switchOrganization`. That PR
relies on auth-kit 1.5.0 (mgpl-diagnostics/auth-kit#13).
## Checks
- `tsc --noEmit` and `npm run build` pass.
- The api's suite, run against this build, passes "every query and
mutation has a client operation" (myOrganizations and switchOrganization
are covered).
- The dashboard's lab picker and switcher were tested end to end against
a mock of the new schema.
---
_Generated by [Claude
Code](https://claude.ai/code/session_018jBohk4otGVRjt3Y1cF1N2)_
Co-authored-by: Claude <noreply@anthropic.com>
BackStacked
added a commit
to mgpl-diagnostics/api
that referenced
this pull request
Nov 10, 2026
One person (one email) can have an account in several labs. This lets
the dashboard show a pick list at sign-in and switch labs once signed
in. The owner chose switching without asking for the password again.
## Changes
- **Pick list at sign-in.** `ORG_REQUIRED` now carries
`extensions.organizations`, a list of `[{ code, name }]`.
- It lists only the labs whose account matched the password, with no
ids.
- A wrong password still lists nothing.
- **Query `myOrganizations: [OrganizationChoice!]!`** returns `{ code,
name, current }` for every lab the person can work in.
- **Mutation `switchOrganization(orgCode: String!, device: DeviceInput):
LoginResult!`**, built on auth-kit `switchOrganization`.
- It takes the lab **code**, not an id, so rule 3 (no `orgId` arguments)
holds.
- An unknown code and a lab without an account both answer
`ORG_UNAVAILABLE`, so codes can't be probed.
- The old session ends.
- The same device rule as `refreshSession` applies.
- The switch is audited in both labs.
- **New error code `ORG_UNAVAILABLE`.** It is in `ERROR_CODES` and
docs/05-errors.md.
- **Docs.** docs/06 has a "One person, several labs" section.
`schema.graphql`, docs/04 and llms-full.txt are regenerated.
## Why this is a draft
It needs **auth-kit 1.5.0** (mgpl-diagnostics/auth-kit#13).
- `kits.json` points auth-kit at that branch's commit for `npm run
kits`.
- `package.json` and `package-lock.json` still pin the published
auth-kit, so CI's `npm ci` + typecheck will fail until 1.5.0 is
published.
- After the release, run `npm install @mgpl-diagnostics/auth-kit@1.5.0`,
set `kits.json` to `v1.5.0`, and mark this ready.
- The client side is mgpl-diagnostics/client (1.5.0); bump its ref here
after it's released.
## Tests
I ran `KITS_SRC=.. npm run kits`, then `npm run typecheck`, then
`TEST_BACKENDS=pg npm test`. The result was 127 passed and 1 failed.
- **New checks on PostgreSQL:**
- the pick list (codes and names, no ids) and nothing on a wrong
password;
- `myOrganizations` for a two-lab and a one-lab person;
- a switch works in the other lab and ends the old session;
- `ORG_UNAVAILABLE` for the current lab, an unknown code, or a lab
without an account;
- no session gives `UNAUTHENTICATED`;
- a different device gives `INVALID_TOKEN` and ends the session.
- **The one failure is not from this change.** It is "client: all
GraphQL operations are valid": client `main` already selects partner-lab
fields (`provenance`, `externalReports`, …) that api `main` doesn't
serve yet. With client 1.5.0 the "every field has a client operation"
check passes.
- **MongoDB didn't run here.** The binary download is blocked by this
environment's proxy (403); CI runs both backends.
---
_Generated by [Claude
Code](https://claude.ai/code/session_018jBohk4otGVRjt3Y1cF1N2)_
---------
Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One person can have an account (same email) in several labs. Until now sign-in answered
ORG_REQUIREDand the client had to know the lab code. The dashboard now wants two things: a pick list at sign-in, and a lab switcher once signed in. The owner chose to allow switching without asking for the password again.Changes
ORG_REQUIREDnames the choices.details.organizationsis anOrgChoice[]of{ orgId, code, name }, sorted by name.INVALID_CREDENTIALS.OrgStore.get(id). db-kit'srepos.orgsalready has it.organizationsOf(userId)returns every active account with the same email, the current one included.switchOrganization({ token, orgId, ip?, userAgent?, device?, tlsFingerprint? })returns whatloginreturns, for the account inorgId.refresh: a differentdeviceIdis refused and ends the session.auth.org_switch_outandauth.org_switch.ORG_UNAVAILABLE. No existing code is renamed.loginis nowissue(), shared with the switch. Login behaviour is unchanged.Tests
npm run typecheck && npm test && npm run buildpasses with 155 checks; there were 131.ORG_UNAVAILABLEcase, and a disabled account.Follow-up
The api needs this release to expose
myOrganizations,switchOrganizationand the pick list. That PR comes next.Generated by Claude Code