feat(organizations): expose organization and permission group administration by waleedlatif1 · Pull Request #8102 · simstudioai/sim

waleedlatif1 · 2026-09-21T07:59:50Z

Summary

Expose permission groups and organization administration through shared application use cases, the public API, CLI, and MCP. Organization operations cover discovery, workspaces, member roles/removal, and invitation create/list/get/resend/revoke.
Keep organization roles separate from workspace permissions, preserve internal workspace-admin invitation access, and enforce current credential, role, and permission-group policies across surfaces.
Align CLI flags and identifiers: --default / --no-default, --user, --all-members, and user IDs for membership removal. Keep workspace discovery under organizations workspaces.
Protect invitation delivery, expiration, concurrent membership changes, pagination, and audit attribution; regenerate API and CLI documentation.
Preserve existing partial-success handling, successful role-update audits, and conflict responses during concurrent membership changes.

Type of Change

Feature
Bug fix

Testing

1,360 focused application and policy tests, 1,182 CLI tests, and 56 documentation tests passed (3 existing CLI tests skipped). All 47 repository audits, all workspace type checks, lint, generated-document checks, and the block-registry check passed. Cleanup completed with no findings. No database migrations or UI changes.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-21T07:59:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 21, 2026 6:23pm UTC

greptile-apps · 2026-09-21T08:04:54Z

Confidence Score: 5/5

The PR appears safe to merge; the prior findings are resolved or withdrawn, and no actionable new regression remains.

Summary

This PR exposes organization and permission-group administration through shared application use cases, internal and public APIs, MCP, and the CLI. It also strengthens invitation and membership mutation behavior and regenerates the corresponding documentation.

Adds organization discovery, workspace, member, and invitation operations.
Adds permission-group CRUD and membership operations with bounded bulk processing.
Centralizes authorization, auditing, pagination, and presentation across API surfaces.
Preserves legacy membership-removal error contracts while allowing application use cases to propagate failures.
Adds database-time expiry protection for scoped invitation revocation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  CLI[CLI] --> Contracts[Shared API contracts]
  MCP[MCP] --> Contracts
  Internal[Internal API] --> Routes[Route adapters]
  Public[Public API v2] --> Routes
  Contracts --> Routes
  Routes --> UseCases[Authorized application use cases]
  UseCases --> Auth[Organization and permission-group authorization]
  UseCases --> Audit[Semantic audit]
  UseCases --> Managers[Domain managers]
  Managers --> DB[(Database)]
  Managers --> Delivery[Invitation delivery]

_{Reviews (8) · Last reviewed commit: "fix(organizations): preserve member admi..."}

cubic-dev-ai

All reported issues were addressed across 51 files

Not reviewed (too large): apps/docs/openapi-v2-resources.json (~12,735 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

…entitlement checks

waleedlatif1 · 2026-09-21T08:13:32Z

@greptile

waleedlatif1 · 2026-09-21T08:13:33Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T08:13:40Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 54 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

Not reviewed (too large): apps/docs/openapi-v2-resources.json (~12,735 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{Re-trigger cubic}

waleedlatif1 · 2026-09-21T17:04:35Z

@greptile

waleedlatif1 · 2026-09-21T17:04:36Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T17:04:43Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-21T17:14:49Z

@greptile

waleedlatif1 · 2026-09-21T17:14:50Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T17:15:00Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-21T17:21:29Z

@greptile

waleedlatif1 · 2026-09-21T17:21:30Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T17:21:35Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-21T17:23:22Z

@greptile Please re-review the resolved contract-documentation finding against the current head. The thread reply cites the repository rule and audit implementation, which exclude nested arbitrary metadata from opaque-response annotations; the other cited comments are unchanged from staging.

cubic-dev-ai

All reported issues were addressed across 106 files

Not reviewed (too large): apps/docs/openapi-v2-resources.json (~14,826 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

waleedlatif1 · 2026-09-21T17:41:17Z

@greptile

waleedlatif1 · 2026-09-21T17:41:18Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T17:41:24Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 108 files

Confidence score: 3/5

apps/sim/lib/invitations/mutation-manager.ts: A policy change between preflight validation and prepareInvitationResend commit can allow a resend under stale admission, grant, or billing rules, creating a concrete authorization or billing consistency risk. Re-evaluate the relevant policies atomically at commit time or otherwise prevent stale-policy commits.

Not reviewed (too large): apps/docs/openapi-v2-resources.json (~14,826 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/invitations/mutation-manager.ts">

<violation number="1" location="apps/sim/lib/invitations/mutation-manager.ts:40">
P2: When an invitation policy changes after these preflight checks but before `prepareInvitationResend` commits, the resend still succeeds under the stale policy. Re-evaluate the admission, grant, and billing policies inside the protected resend operation (or lock/version those policies) before sending the email.</violation>
</file>

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-09-21T17:58:48Z

@greptile

waleedlatif1 · 2026-09-21T17:58:49Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T17:58:54Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 115 files

Not reviewed (too large): apps/docs/openapi-v2-resources.json (~14,826 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-09-21T18:22:13Z

@greptile

waleedlatif1 · 2026-09-21T18:22:14Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-21T18:22:21Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 115 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

Not reviewed (too large): apps/docs/openapi-v2-resources.json (~14,826 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Re-trigger cubic}

feat(permission-groups): expose administration through API CLI and MCP

eba6605

vercel Bot deployed to Preview September 21, 2026 08:01 View deployment

greptile-apps Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread apps/sim/lib/permission-groups/member-manager.ts Outdated

Comment thread packages/sim-cli/src/contract/commands.ts

cubic-dev-ai Bot reviewed Sep 21, 2026

View reviewed changes

fix(permission-groups): preserve bulk membership behavior and locked …

f332ca6

…entitlement checks

vercel Bot deployed to Preview September 21, 2026 08:14 View deployment

cubic-dev-ai Bot reviewed Sep 21, 2026

View reviewed changes

feat(organizations): align administration across API CLI and MCP

96bf07f

waleedlatif1 changed the title ~~feat(permission-groups): expose administration through API CLI and MCP~~ feat(organizations): expose organization and permission group administration Sep 21, 2026

vercel Bot deployed to Preview September 21, 2026 17:06 View deployment

fix(docs): include organization endpoints in OpenAPI coverage

7988618

vercel Bot deployed to Preview September 21, 2026 17:16 View deployment

greptile-apps Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread apps/sim/lib/api/contracts/organization.ts

cubic-dev-ai Bot reviewed Sep 21, 2026

View reviewed changes

fix(organizations): harden invitation delivery and mutation boundaries

22e5858

vercel Bot temporarily deployed to Preview September 21, 2026 17:40 Inactive

greptile-apps Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread apps/sim/lib/invitations/core.ts

cubic-dev-ai Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread apps/sim/lib/invitations/mutation-manager.ts Outdated

Comment thread apps/sim/lib/invitations/send.ts Outdated

fix(invitations): revalidate policy and expiry under mutation locks

d520146

vercel Bot temporarily deployed to Preview September 21, 2026 17:58 Inactive

cubic-dev-ai Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread apps/sim/lib/invitations/mutation-manager.ts

fix(organizations): preserve member administration compatibility

b394cd6

vercel Bot deployed to Preview September 21, 2026 18:23 View deployment

cubic-dev-ai Bot reviewed Sep 21, 2026

View reviewed changes

waleedlatif1 merged commit 666a971 into staging Sep 21, 2026
35 checks passed

waleedlatif1 deleted the codex/permission-groups-api branch September 21, 2026 19:53

waleedlatif1 mentioned this pull request Sep 21, 2026

v0.8.52: org and perm group cli endpoints, upgrade trigger #8120

Merged

Conversation

waleedlatif1 commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 21, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

waleedlatif1 commented Sep 21, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 21, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 21, 2026 •

edited

Loading

vercel Bot commented Sep 21, 2026 •

edited

Loading

greptile-apps Bot commented Sep 21, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading