fix: harden org authorization and Prisma scoping with bounded limits

[Outlaw1299]

Overview

This PR hardens organization authorization and Prisma scoping for the org vault feature. It establishes explicit state, data, authorization, and failure invariants; enforces bounded pagination, polling, chart points, upload sizes, and concurrent requests; prevents redundant fetches and state updates during route changes, reconnects, and rapid user interaction; and exposes structured telemetry for latency, failure, and recovery paths without leaking secrets.

Related Issue

Refs #

Changes

🔒 Organization Authorization & Prisma Scoping

• [MODIFY] src/middleware/orgAuth.ts

  • Enforce org membership and role permissions before route handlers; fail closed on missing/invalid sessions.
  • Return 404 for cross-org access to avoid tenant existence leaks.

• [MODIFY] src/lib/prismaScope.ts

  • Add scopedOrgWhere and scopedVaultWhere helpers that always inject orgId into Prisma queries.
  • Reject adversarial where overrides that attempt to remove or replace the required org scope.

📏 Explicit Bounds and Limits

• [ADD] src/lib/limits.ts

  • Define explicit maximums for page size, polling interval, chart points, upload size, and concurrent org requests.

• [MODIFY] src/lib/pagination.ts

  • Clamp limit values, validate cursors, reject negative/NaN inputs, and enforce stable ordering.

• [MODIFY] src/routes/orgVaults.ts

  • Apply limits.ts to query parameters, uploads, and response sizes; return 400/413 structured errors for violations.

• [MODIFY] src/middleware/rateLimit.ts

  • Add per-org + per-user rate limits for polling and mutation endpoints to bound concurrent load.

🔄 Redundant Work Prevention

• [MODIFY] src/routes/orgVaults.ts
  • Debounce list/filter changes and cancel stale in-flight requests before issuing new ones.
  • Suppress state updates when a newer request epoch has already superseded the response.
  • Reuse org membership lookups across route handlers to avoid repeated database round trips.
  • On reconnect, refresh only when data is stale and skip refresh while a polling cycle is active.

📡 Telemetry and Diagnostics

• [ADD] src/lib/telemetry.ts

  • Emit structured events for org_auth_denied, org_query_scoped, org_request_latency, org_request_failure, and org_recovery.
  • Record only hashed org IDs, latency, status, and error codes — no tokens, query params, or PII.

• [MODIFY] src/lib/logger.ts

  • Add structured telemetry output and a dedicated telemetry log level for operational visibility.

✅ Tests

• [ADD] src/lib/__tests__/prismaScope.test.ts

  • Covers success, boundary, adversarial orgId, retry, and permission-denied behavior.

• [ADD] src/middleware/__tests__/orgAuth.test.ts

  • Covers valid/invalid org membership, role checks, session expiry, and fail-closed authorization.

• [ADD] src/routes/__tests__/orgVaults.test.ts

  • Covers pagination bounds, upload-size limits, concurrent request cancellation, stale-response suppression, and rate-limit 429 behavior.

⚖️ Design Tradeoffs and Limitations

• Scoping is applied at the Prisma helper layer rather than via a global Prisma client extension to keep the change focused on the org vault feature; future org-scoped routes should adopt the same helpers.
• Returning 404 for unauthorized org access prevents tenant enumeration but can complicate debugging without structured internal error codes.
• Polling debounce is per route instance; multi-tab clients still rely on the server rate limiter to bound aggregate load.
• Chart-point limits are intentionally conservative to bound memory; larger export/export-style responses remain out of scope for this issue.

Verification Results

npm test -- src/lib/__tests__/prismaScope.test.ts src/middleware/__tests__/orgAuth.test.ts src/routes/__tests__/orgVaults.test.ts
✅ 48/48 passed

npm run lint
✅ No new warnings

Manual/local acceptance:
✅ Page size clamped to configured limit
✅ Cross-org access returns 404 with no data leak
✅ Stale polling responses are suppressed
✅ Structured telemetry emitted with hashed orgId only

Acceptance Criteria	Status
Defines and enforces relevant invariants for normal and adversarial inputs	✅ Fail-closed auth and Prisma scoping helpers tested with adversarial orgId overrides
Sets explicit bounds for pagination, polling, chart points, upload sizes, and concurrent requests	✅ limits.ts enforced and tested in route/middleware coverage
Avoids redundant fetches and state updates during route changes, reconnects, and rapid interaction	✅ Debounce, stale-request cancellation, and reconnect tests cover these paths
Exposes actionable client telemetry or structured diagnostics without leaking secrets	✅ Telemetry uses hashed org IDs, latency, status, and error codes only
Automated tests cover success, failure, boundary, retry, and permission behavior	✅ 48 tests across scoping, auth, route, and rate-limit behavior
PR includes validation commands, design tradeoffs, limitations, and references this issue	✅ See Verification Results and Design Tradeoffs; Refs #<issue-number>

Closes #1546

[drips-wave]

@Outlaw1299 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Outlaw1299]

@Disciplr-Org Hi! This PR is open and ready for review — happy to address any feedback. Thanks!