release(v2.24.0): DOS.Me JIT teams claims, auth sync & ecosystem stability by JOY · Pull Request #31 · DOS/Crove-Post

JOY (JOY) · 2026-09-03T05:35:59Z

What kind of change does this PR introduce?

Release: v2.24.0 - Full ecosystem synchronization, DOS.Me Organization & Teams JIT token claims support, and production stability enhancements.

Why was this change needed?

To release Crove Post v2.24.0 incorporating:

DOS.Me Organization -> Teams Hierarchy and Zero-Latency JIT Token Claims (teams scope, active_org_id, teams: [{ id, org_id, name, slug, role }]).
JIT Organization Synchronization in AuthService.checkExists() and canonical orgId passing.
OpenAI-Compatible API Gateway dynamic configuration support.
Upstream Postiz updates (Post Workflow v1.1.1, RevenueCat billing, Seedance video provider).
Cross-platform Chrome Extension Manifest V3 build system (build.mjs).

Technical Details & Scope

apps/backend/src/services/auth/providers/oauth.provider.ts:
- Added teams scope (openid profile email organizations teams offline_access).
- Added parsing for active_org_id and teams in getUser().
apps/backend/src/services/auth/auth.service.ts:
- Extracted centralized syncUserOrganizations() and added it to checkExists().
libraries/nestjs-libraries/src/database/prisma/schema.prisma:
- Added provider column (@default("stripe")) to Subscription model for multi-provider billing.
docs/sso-architecture.md & CHANGELOG.md:
- Updated architectural contracts and release documentation for v2.24.0.

Verification & Testing

Verified all builds: pnpm --filter ./apps/backend run build, pnpm --filter ./apps/orchestrator run build.
Verified SSO Vitest test suite: pnpm --filter @crove/sso test (31/31 passed).
Verified Branding Guard validation: pnpm dlx tsx scripts/branding-guard.ts (100% passed).
Live health check verified: https://post.crove.com/api/health & https://beta-post.crove.com/api/health.

QA

Log in via SSO DOS ID on post.crove.com/auth
Verify that the user's canonical organizations (JOY, DOS, Crove) and teams are loaded
Switch between organizations and verify context is preserved
Verify /api/health endpoint returns 200 OK

Checklist:

My code follows the project's code style and architectural conventions.
Local build passes (pnpm run build).
Tests and typecheck have been verified without errors.
Documentation has been updated (if applicable).
No secrets or sensitive credentials are included in this PR.
I have filled in the QA / Verification section above with real steps to verify this change.

Note

Medium Risk
Changes login authorization scopes and identity claim parsing on the auth path; mis-parsed claims could affect workspace context for returning SSO users.

Overview
v2.24.0 extends DOS.Me SSO so Crove Post requests the teams scope and surfaces richer UserInfo/JIT claims on login.

The generic OAuth provider and AuthProviderAbstract now include active_org_id, organization entries with optional slug and SUPERADMIN, and a teams array (id, org_id, name, slug, role). OauthProvider.generateLink() defaults scopes to openid profile email organizations teams offline_access, and getUser() maps those fields from the token payload (including user_metadata fallbacks). docs/sso-architecture.md documents the unified org/teams JWT contract for zero-latency JIT provisioning across Crove apps. CHANGELOG.md records the broader v2.24.0 release (auth sync fixes, OpenAI gateway envs, extension build, subscription provider column, upstream merge) even though this diff is mainly the OAuth contract and docs.

^{Reviewed by Cursor Bugbot for commit 2643e24. Configure here.}

…uth provider

cursor · 2026-09-03T05:36:08Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_887855d8-7a16-478c-b3bb-af85781da512)

gemini-code-assist

Code Review

This pull request introduces support for the DOS.Me Organization and Teams hierarchy, including JIT token claims, by updating the OAuth provider, authentication interfaces, and documentation. The review feedback suggests improving TypeScript type safety and IDE autocompletion for team roles by using the (string & {}) idiom instead of a raw string union. Additionally, it recommends using optional chaining when parsing the OAuth payload to prevent potential runtime errors if the payload or its metadata is undefined.

gemini-code-assist · 2026-09-03T05:37:52Z

-    organizations?: Array<{ id: string; name: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' }>;
+    active_org_id?: string;
+    organizations?: Array<{ id: string; name: string; slug?: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' | 'SUPERADMIN' }>;
+    teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | string }>;


In TypeScript, unioning specific string literal types (like 'LEAD' | 'MEMBER') with the generic string type causes the entire union to collapse into string. This defeats type safety and autocompletion for the specific roles. To preserve IDE autocompletion for 'LEAD' and 'MEMBER' while still allowing any custom string, use the (string & {}) idiom.

Suggested change

teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | string }>;

teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | (string & {}) }>;

gemini-code-assist · 2026-09-03T05:37:52Z

-    organizations?: Array<{ id: string; name: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' }>;
+    active_org_id?: string;
+    organizations?: Array<{ id: string; name: string; slug?: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' | 'SUPERADMIN' }>;
+    teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | string }>;


In TypeScript, unioning specific string literal types (like 'LEAD' | 'MEMBER') with the generic string type causes the entire union to collapse into string. This defeats type safety and autocompletion for the specific roles. To preserve IDE autocompletion for 'LEAD' and 'MEMBER' while still allowing any custom string, use the (string & {}) idiom.

Suggested change

teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | string }>;

teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | (string & {}) }>;

gemini-code-assist · 2026-09-03T05:37:52Z

      id: payload.sub || payload.id,
      name: payload.name || payload.full_name || payload.user_metadata?.name || payload.user_metadata?.full_name,
      picture: payload.picture || payload.avatar_url || payload.user_metadata?.picture || payload.user_metadata?.avatar_url,
+      active_org_id: payload.active_org_id || payload.user_metadata?.active_org_id,


To prevent potential runtime TypeError exceptions if payload or payload.user_metadata is null or undefined, use optional chaining (payload?.active_org_id and payload?.user_metadata?.active_org_id).

Suggested change

active_org_id: payload.active_org_id || payload.user_metadata?.active_org_id,

active_org_id: payload?.active_org_id || payload?.user_metadata?.active_org_id,

gemini-code-assist · 2026-09-03T05:37:52Z

      picture: payload.picture || payload.avatar_url || payload.user_metadata?.picture || payload.user_metadata?.avatar_url,
+      active_org_id: payload.active_org_id || payload.user_metadata?.active_org_id,
      organizations: payload.organizations || payload.user_metadata?.organizations || [],
+      teams: payload.teams || payload.user_metadata?.teams || [],


To prevent potential runtime TypeError exceptions if payload or payload.user_metadata is null or undefined, use optional chaining (payload?.teams and payload?.user_metadata?.teams).

Suggested change

teams: payload.teams || payload.user_metadata?.teams || [],

teams: payload?.teams || payload?.user_metadata?.teams || [],

JOY (JOY) added 2 commits September 3, 2026 12:30

feat(auth): integrate DOS.Me JIT teams claims and scope support in OA…

bbea9b2

…uth provider

docs(changelog): document v2.24.0 release highlights

2643e24

JOY (JOY) merged commit 3b2712a into main Sep 3, 2026
14 checks passed

gemini-code-assist Bot reviewed Sep 3, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

release(v2.24.0): DOS.Me JIT teams claims, auth sync & ecosystem stability - #31

release(v2.24.0): DOS.Me JIT teams claims, auth sync & ecosystem stability#31
JOY (JOY) merged 2 commits into
mainfrom
dev

JOY (JOY) commented Sep 3, 2026 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot commented Sep 3, 2026

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' \| 'MEMBER' \| string }>;
	teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' \| 'MEMBER' \| (string & {}) }>;

	active_org_id: payload.active_org_id \|\| payload.user_metadata?.active_org_id,
	active_org_id: payload?.active_org_id \|\| payload?.user_metadata?.active_org_id,

	teams: payload.teams \|\| payload.user_metadata?.teams \|\| [],
	teams: payload?.teams \|\| payload?.user_metadata?.teams \|\| [],

Uh oh!

Uh oh!

Conversation

JOY (JOY) commented Sep 3, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What kind of change does this PR introduce?

Why was this change needed?

Technical Details & Scope

Verification & Testing

QA

Checklist:

Uh oh!

cursor Bot commented Sep 3, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

JOY (JOY) commented Sep 3, 2026 •

edited by cursor Bot

Loading