fix(api): anchor OIDC-created user's Personal org to the default region by lilongen · Pull Request #668 · boxlite-ai/boxlite

lilongen · 2026-06-07T07:14:12Z

Summary

On first OIDC login, JwtStrategy.validate auto-creates the user. It passed personalOrganizationQuota but not personalOrganizationDefaultRegionId, so the downstream chain:

UserService.create → UserCreatedEvent → OrganizationService.handleUserCreatedEvent

created the user's Personal organization with defaultRegionId: undefined. Any downstream caller that reads organization.defaultRegionId then fails for every OIDC-created user.

AppService's admin-seed path already sets personalOrganizationDefaultRegionId (app.service.ts); this just brings the normal login path in line — a one-field change mirroring existing, proven code.

Why a separate PR

This was originally bundled into #595 (infra-local). Per @DorianZheng's review ("why change this in this PR?") it's been pulled out, since it's an app-behavior fix unrelated to the local-dev stack.

Test

Adds apps/api/src/auth/jwt.strategy.spec.ts asserting the create DTO carries the configured defaultRegion.id.

Two-sided verification (CLAUDE.md reproduce-before-fix):

Without the fix: ❌ fails — create() is called with the DTO missing personalOrganizationDefaultRegionId.
With the fix: ✅ passes.

nx test api --testPathPatterns="jwt.strategy.spec"

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

Bug Fixes
- Fixed auto-created user initialization to ensure proper default region assignment during OIDC authentication, preventing potential downstream errors.
Tests
- Added test coverage for user auto-creation during authentication validation.

JwtStrategy.validate auto-creates a user on first OIDC login. It passed personalOrganizationQuota but not personalOrganizationDefaultRegionId, so the downstream UserCreatedEvent -> OrganizationService.handleUserCreatedEvent created the Personal org with defaultRegionId=undefined. Downstream callers that read organization.defaultRegionId then fail for every OIDC-created user. AppService's admin-seed path already sets personalOrganizationDefaultRegionId; this brings the normal login path in line. Add jwt.strategy.spec.ts asserting the create DTO carries the configured defaultRegion.id (fails without the fix: create() called without the field). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-06-07T07:14:24Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b0a35820-a948-426d-a180-eaa6eae499b2

📥 Commits

Reviewing files that changed from the base of the PR and between fe557e7 and 79dc13c.

📒 Files selected for processing (2)

apps/api/src/auth/jwt.strategy.spec.ts
apps/api/src/auth/jwt.strategy.ts

📝 Walkthrough

Walkthrough

JwtStrategy now anchors auto-created Personal organizations to the platform's configured default region by setting personalOrganizationDefaultRegionId during user creation. A corresponding test validates this behavior by stubbing config and user service, then asserting the region id is correctly passed to user creation.

Changes

Auto-Created User Default Region Assignment

Layer / File(s)	Summary
User creation region assignment `apps/api/src/auth/jwt.strategy.ts`	JwtStrategy.validate now includes `personalOrganizationDefaultRegionId` from config's `defaultRegion.id` when auto-creating users, with comments explaining the alignment to admin-seed defaults and preventing undefined region ids downstream.
Auto-creation region assignment test `apps/api/src/auth/jwt.strategy.spec.ts`	Test module with stubbed dependencies validates that when JwtStrategy.validate encounters a new OIDC user (UserService.findOne returns null), it calls UserService.create with an object containing `personalOrganizationDefaultRegionId` set to the configured default region id.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐇 A new user springs forth from the auth flow,
With region in hand, they're ready to grow.
Default from config, no more null in sight,
Personal orgs bloom in the right region's light! 🌱

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: fixing OIDC-created users' Personal organizations to be anchored to the platform's default region, which is the core bug fix in the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cla-assistant · 2026-06-07T07:14:26Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

lile seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cla-assistant · 2026-06-07T07:14:27Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

lile seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Anchors the auto-created Personal organization for OIDC/JWT-created users to the platform’s configured default region to prevent downstream access to organization.defaultRegionId from failing.

Changes:

Pass personalOrganizationDefaultRegionId into the new-user create DTO using defaultRegion.id from config.
Add a Jest spec verifying the create call includes the configured default region id.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
apps/api/src/auth/jwt.strategy.ts	Adds default region id to the new user creation payload so the Personal org is created with a non-undefined `defaultRegionId`.
apps/api/src/auth/jwt.strategy.spec.ts	Introduces a unit test asserting the strategy forwards the configured default region id into `UserService.create()`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

law-chain-hot · 2026-06-07T08:37:06Z

Looks good to me.

For MVP, covering the OIDC first-login/new-user path is enough. We are not live yet, so we do not need a backfill for existing org rows.

Only remaining blocker is the CLA/email check before merge. @lilongen Please try this link: http://cla-assistant.io/boxlite-ai/boxlite

…r infra-local Re-add the OIDC user-create default-region fix that was split to PR boxlite-ai#668. Removing it from this branch broke infra-local: a fresh Dex login creates a Personal org with defaultRegionId=NULL, and dashboard create-sandbox then fails with HTTP 428 "organization does not have a default region" (caught by E2E). Like the runner arm64 (boxlite-ai#671) and cron orderby (boxlite-ai#672) fixes, this is a general fix the local stack depends on, so it stays in-branch until boxlite-ai#668 lands on main; it drops from this PR's diff on the next rebase. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings June 7, 2026 07:14

Copilot AI reviewed Jun 7, 2026

View reviewed changes

law-chain-hot approved these changes Jun 7, 2026

View reviewed changes

DorianZheng merged commit 87aefad into boxlite-ai:main Jun 8, 2026
10 of 11 checks passed

coderabbitai Bot mentioned this pull request Jun 8, 2026

feat(infra-local): BoxLite-based local dev stack (L1 + L2 + M5 native runner) #595

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(api): anchor OIDC-created user's Personal org to the default region#668

fix(api): anchor OIDC-created user's Personal org to the default region#668
DorianZheng merged 1 commit into
boxlite-ai:mainfrom
lilongen:fix/jwt-personal-org-default-region

lilongen commented Jun 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 7, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

cla-assistant Bot commented Jun 7, 2026

Uh oh!

cla-assistant Bot commented Jun 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

law-chain-hot commented Jun 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

lilongen commented Jun 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why a separate PR

Test

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

cla-assistant Bot commented Jun 7, 2026

Uh oh!

cla-assistant Bot commented Jun 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

law-chain-hot commented Jun 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lilongen commented Jun 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 7, 2026 •

edited

Loading