feat: Scope oauth tokens by org, replace flat project list with org-keyed map

apps/code/src/main/services/agent/service.test.ts

@@ -343,13 +343,14 @@ describe("AgentService", () => {
     it("recordActivity resets the timeout on subsequent calls", () => {
       injectSession(service, "run-1");
       service.recordActivity("run-1");
-      const firstDeadline = getIdleTimeouts(service).get("run-1")?.deadline;
+      const firstDeadline =
+        getIdleTimeouts(service).get("run-1")?.deadline ?? 0;
 
       vi.advanceTimersByTime(5 * 60 * 1000);
       service.recordActivity("run-1");
       const secondDeadline = getIdleTimeouts(service).get("run-1")?.deadline;
 
-      expect(secondDeadline).toBeGreaterThan(firstDeadline!);
+      expect(secondDeadline).toBeGreaterThan(firstDeadline);
     });
 
     it("kills idle session after timeout expires", () => {

apps/code/src/main/services/oauth/schemas.ts

@@ -24,7 +24,6 @@ export const oAuthTokenResponse = z.object({
   token_type: z.string(),
   scope: z.string().optional().default(""),
   refresh_token: z.string(),
-  scoped_teams: z.array(z.number()).optional(),
   scoped_organizations: z.array(z.string()).optional(),
 });
 export type OAuthTokenResponse = z.infer<typeof oAuthTokenResponse>;

apps/code/src/renderer/api/posthogClient.ts

@@ -132,8 +132,8 @@ export class PostHogAPIClient {
     }
   }
 
-  setTeamId(teamId: number): void {
-    this._teamId = teamId;
+  setTeamId(teamId: number | null | undefined): void {
+    this._teamId = teamId ?? null;
   }
 
   private async getTeamId(): Promise<number> {
@@ -167,6 +167,32 @@ export class PostHogAPIClient {
     });
   }
 
+  async listOrgProjects(
+    orgId: string,
+  ): Promise<{ id: number; name: string }[]> {
+    const url = new URL(
+      `${this.api.baseUrl}/api/organizations/${orgId}/projects/`,
+    );
+    const response = await this.api.fetcher.fetch({
+      method: "get",
+      url,
+      path: `/api/organizations/${orgId}/projects/`,
+    });
+
+    if (!response.ok) {
+      throw new Error(
+        `Failed to fetch projects for org ${orgId}: ${response.statusText}`,
+      );
+    }
+
+    const data = await response.json();
+    const results = data.results ?? data ?? [];
+    return results.map((p: { id: number; name?: string }) => ({
+      id: p.id,
+      name: p.name ?? `Project ${p.id}`,
+    }));
+  }
+
   async getProject(projectId: number) {
     //@ts-expect-error this is not in the generated client
     const data = await this.api.get("/api/projects/{project_id}/", {

apps/code/src/renderer/features/auth/stores/authStore.test.ts

@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mockGetCurrentUser = vi.fn();
+const mockListOrgProjects = vi.fn();
 
 const { getItem, setItem } = vi.hoisted(() => ({
   getItem: vi.fn(),
@@ -69,6 +70,7 @@ vi.mock("@renderer/api/posthogClient", () => ({
     this: Record<string, unknown>,
   ) {
     this.getCurrentUser = mockGetCurrentUser;
+    this.listOrgProjects = mockListOrgProjects;
     this.setTeamId = vi.fn();
   }),
 }));
@@ -88,7 +90,6 @@ function makeStoredTokens(overrides: Record<string, unknown> = {}) {
     refreshToken: "test-refresh-token",
     expiresAt: Date.now() + 3600 * 1000,
     cloudRegion: "us" as const,
-    scopedTeams: [1],
     scopeVersion: OAUTH_SCOPE_VERSION,
     ...overrides,
   };
@@ -107,6 +108,7 @@ describe("authStore - scope version", () => {
     getItem.mockResolvedValue(null);
     setItem.mockResolvedValue(undefined);
     mockGetCurrentUser.mockResolvedValue(mockUser);
+    mockListOrgProjects.mockResolvedValue([]);
 
     useAuthStore.setState({
       oauthAccessToken: null,
@@ -118,8 +120,7 @@ describe("authStore - scope version", () => {
       isAuthenticated: false,
       client: null,
       projectId: null,
-      availableProjectIds: [],
-      availableOrgIds: [],
+      orgProjectsMap: {},
       needsProjectSelection: false,
       needsScopeReauth: false,
     });
@@ -186,7 +187,6 @@ describe("authStore - scope version", () => {
           access_token: "new-access-token",
           refresh_token: "new-refresh-token",
           expires_in: 3600,
-          scoped_teams: [1],
           scoped_organizations: ["org-1"],
         },
       });
@@ -215,7 +215,7 @@ describe("authStore - scope version", () => {
           access_token: "new-access-token",
           refresh_token: "new-refresh-token",
           expires_in: 3600,
-          scoped_teams: [1],
+          scoped_organizations: ["org-1"],
         },
       });
 
@@ -242,7 +242,7 @@ describe("authStore - scope version", () => {
           access_token: "new-access-token",
           refresh_token: "new-refresh-token",
           expires_in: 3600,
-          scoped_teams: [1],
+          scoped_organizations: ["org-1"],
         },
       });