devin-ai-integration · 2026-08-24T16:09:14Z

Context

Customer report: DELETE /api/v2/organizations/{orgId}/memberships/{membershipId} returned 200 with an empty body, but the user was never removed.

Root cause: the v2 org membership PATCH, DELETE, and bulk DELETE routes advertise IDENTITY_ACCESS_TOKEN in verifyAuth, but their handlers began with:

if (req.auth.actor !== ActorType.USER) return;

so any call authenticated with a machine identity token silently no-oped and returned 200 with an empty response — the delete never ran.

Fix: thread the real actor through instead of hard-coding ActorType.USER:

TUpdateOrgMembershipDTO / TDeleteOrgMembershipDTO / TDeleteOrgMembershipsDTO now extend TOrgPermission (actor + actorId instead of userId)
updateOrgMembership / deleteOrgMembership / bulkDeleteOrgMemberships pass actor/actorId to getOrgPermission, so machine identities go through the normal CASL org-permission check (Edit/Delete on Member)
Self-modification guards (Cannot update own organization membership, self-delete checks) only apply when the actor is a user
Removed the silent early returns from the three route handlers

Machine identities with the appropriate org Member permissions can now actually update/delete user memberships; identities without permission get a proper 403 instead of a fake 200.

Steps to verify the change

Create a machine identity with an org role granting Delete on Member; attach org-level auth.
DELETE /api/v2/organizations/{orgId}/memberships/{membershipId} with the identity access token → membership is deleted and returned in the response.
Repeat with an identity lacking the permission → 403.
User JWT flows behave as before (including self-delete/self-update rejection).

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

Link to Devin session: https://app.devin.ai/sessions/fbf6011cd8a744f897de3650f9e35316
Requested by: @ashwin-infisical

…lete endpoints Co-Authored-By: ashwin <ashwin@infisical.com>

devin-ai-integration · 2026-08-24T16:09:18Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

greptile-apps · 2026-08-24T16:14:16Z

Greptile Summary

The PR enables machine identities to execute organization membership update and deletion operations instead of silently returning success.

Threads the authenticated actor type and ID from the v2 routes into organization permission checks.
Restricts user-specific self-modification protections to human user actors.
Updates organization membership service DTOs to use the shared actor-aware permission context.

Confidence Score: 5/5

The PR appears safe to merge, with actor-aware authorization preserved across the newly enabled machine-identity paths.

The changed routes pass complete authenticated actor context into existing organization-scoped permission checks, while deletion cleanup remains intact and user self-modification protections continue to apply to user actors.

Important Files Changed

Filename	Overview
backend/src/server/routes/v2/organization-router.ts	Removes user-only no-op guards and forwards the authenticated actor context to all three membership mutation services.
backend/src/services/org/org-service.ts	Authorizes membership mutations using the actual actor while preserving user-only self-update and self-removal protections.
backend/src/services/org/org-types.ts	Replaces user-specific mutation DTO fields with the shared actor-aware organization permission contract.

_{Reviews (1): Last reviewed commit: "fix(org): support machine identity actor..." | Re-trigger Greptile}

fix(org): support machine identity actors on org membership update/de…

a3d86d2

…lete endpoints Co-Authored-By: ashwin <ashwin@infisical.com>

devin-ai-integration Bot assigned ashwin-infisical Aug 24, 2026

Navigation Menu

Uh oh!

fix(org): support machine identity actors on org membership update/delete endpoints - #7785