fix(auth): isolate organization access by credential

server/public/admin-brands.html

@@ -915,7 +915,8 @@ <h2 id="viewModalTitle">Brand Details</h2>
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({
             brand_domain: domain,
-            brand_json: brandJson
+            brand_json: brandJson,
+            organization_id: localStorage.getItem('selectedOrgId') || ''
           })
         });
 
@@ -973,7 +974,8 @@ <h2 id="viewModalTitle">Brand Details</h2>
       }
 
       try {
-        const response = await fetch(`/api/brands/hosted/${encodeURIComponent(domain)}`, {
+        const selectedOrgId = localStorage.getItem('selectedOrgId') || '';
+        const response = await fetch(`/api/brands/hosted/${encodeURIComponent(domain)}?org=${encodeURIComponent(selectedOrgId)}`, {
           method: 'DELETE'
         });
 

server/public/admin-properties.html

@@ -650,7 +650,8 @@ <h2 id="viewModalTitle">Property Details</h2>
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({
             publisher_domain: domain,
-            adagents_json: adagentsJson
+            adagents_json: adagentsJson,
+            organization_id: localStorage.getItem('selectedOrgId') || ''
           })
         });
 
@@ -708,7 +709,8 @@ <h2 id="viewModalTitle">Property Details</h2>
       }
 
       try {
-        const response = await fetch(`/api/properties/hosted/${encodeURIComponent(domain)}`, {
+        const selectedOrgId = localStorage.getItem('selectedOrgId') || '';
+        const response = await fetch(`/api/properties/hosted/${encodeURIComponent(domain)}?org=${encodeURIComponent(selectedOrgId)}`, {
           method: 'DELETE'
         });
 

server/public/brand-builder.html

@@ -3800,6 +3800,11 @@ <h4>${escapeHtml(brand.name || brand.brand_id || 'Untitled Brand')}</h4>
 
       async function saveToRegistry() {
         if (!currentDomain) return;
+        const selectedOrgId = new URLSearchParams(window.location.search).get('org') || localStorage.getItem('selectedOrgId');
+        if (!selectedOrgId) {
+          alert('Select an organization from the dashboard before saving brand setup.');
+          return;
+        }
         const btn = document.getElementById('save-registry-btn');
         const originalText = btn.textContent;
         btn.disabled = true;
@@ -3812,6 +3817,7 @@ <h4>${escapeHtml(brand.name || brand.brand_id || 'Untitled Brand')}</h4>
             headers: { 'Content-Type': 'application/json' },
             credentials: 'include',
             body: JSON.stringify({
+              organization_id: selectedOrgId,
               domain: currentDomain,
               brand_name: getSetupBrandName(json),
               brand_json: json,

server/public/brand-viewer.html

@@ -1733,6 +1733,7 @@ <h3>Upload logo</h3>
         const form = new FormData();
         form.append('file', uploadFile);
         form.append('tags', tags.join(','));
+        form.append('organization_id', localStorage.getItem('selectedOrgId') || '');
         if (note) form.append('note', note);
 
         try {
@@ -2415,6 +2416,7 @@ <h3>Upload logo</h3>
           if (body.brand_manifest[k] === undefined) delete body.brand_manifest[k];
         });
         if (Object.keys(body.brand_manifest).length === 0) delete body.brand_manifest;
+        body.organization_id = localStorage.getItem('selectedOrgId') || '';
 
         try {
           const resp = await fetch(`/api/brands/discovered/${encodeURIComponent(currentDomain)}`, {
@@ -2585,7 +2587,10 @@ <h3>Upload logo</h3>
             method: 'POST',
             credentials: 'include',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ to_revision: revisionNumber }),
+            body: JSON.stringify({
+              to_revision: revisionNumber,
+              organization_id: localStorage.getItem('selectedOrgId') || '',
+            }),
           });
 
           if (!resp.ok) {

server/public/certification.html

@@ -1843,7 +1843,8 @@ <h2>My protocol contributions</h2>
         if (!contentEl) return;
 
         try {
-          var resp = await fetch('/api/certification/modules/' + encodeURIComponent(modId), {credentials: 'include'});
+          var selectedOrgId = localStorage.getItem('selectedOrgId') || '';
+          var resp = await fetch('/api/certification/modules/' + encodeURIComponent(modId) + '?org=' + encodeURIComponent(selectedOrgId), {credentials: 'include'});
           if (!resp.ok) throw new Error('fetch failed');
           var data = await resp.json();
           var dims = (data.assessment_criteria && data.assessment_criteria.dimensions) || [];

server/public/chat.html

@@ -6422,7 +6422,13 @@ <h2>Ask Addie</h2>
         setReadOnlyMode(true, 'video');
 
         try {
-          const res = await authFetch('/api/addie/video/session', { method: 'POST' });
+          const selectedOrgId = getSelectedOrganizationId();
+          if (!selectedOrgId) throw new Error('Select an organization before starting a video call');
+          const res = await authFetch('/api/addie/video/session', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ organization_id: selectedOrgId }),
+          });
           if (!res.ok) {
             const data = await res.json().catch(() => ({}));
             throw new Error(data.error || 'Failed to start video session');

server/public/dashboard-agents.html

@@ -1248,7 +1248,7 @@
       const encoded = encodeURIComponent(agent.url);
       const orgQuery = organizationId ? `?org=${encodeURIComponent(organizationId)}` : '';
       const endpoints = [
-        `/api/registry/agents/${encoded}/compliance`,
+        `/api/registry/agents/${encoded}/compliance${orgQuery}`,
         `/api/registry/agents/${encoded}/compliance/history?limit=10`,
         `/api/registry/agents/${encoded}/auth-status${orgQuery}`,
       ];
@@ -1564,7 +1564,7 @@ <h1>Agents</h1>
       const previous = agent.visibility || 'private';
       if (previous === target) return;
       try {
-        const resp = await fetch(`/api/me/member-profile/agents/${index}/visibility`, {
+        const resp = await fetch(`/api/me/member-profile/agents/${index}/visibility?org=${encodeURIComponent(pageState.orgId)}`, {
           method: 'PATCH',
           credentials: 'include',
           headers: { 'Content-Type': 'application/json' },
@@ -1772,7 +1772,7 @@ <h1>Agents</h1>
       let rows = cachedStoryboardStatuses(agentUrl);
       if (rows.length === 0) {
         try {
-          const res = await fetch('/api/registry/agents/' + encodeURIComponent(agentUrl) + '/storyboard-status', { credentials: 'include' });
+          const res = await fetch('/api/registry/agents/' + encodeURIComponent(agentUrl) + '/storyboard-status?org=' + encodeURIComponent(pageState.orgId), { credentials: 'include' });
           if (res.ok) {
             const data = await res.json();
             rows = Array.isArray(data.storyboards) ? data.storyboards : [];
@@ -2526,7 +2526,7 @@ <h1>Agents</h1>
           method: 'PUT',
           headers: { 'Content-Type': 'application/json' },
           credentials: 'include',
-          body: JSON.stringify({ opt_out: !checkbox.checked }),
+          body: JSON.stringify({ opt_out: !checkbox.checked, organization_id: pageState.orgId }),
         });
         if (!res.ok) {
           checkbox.checked = !checkbox.checked;
@@ -3189,7 +3189,7 @@ <h1>Agents</h1>
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             credentials: 'include',
-            body: JSON.stringify({ paused: toggle.checked }),
+            body: JSON.stringify({ paused: toggle.checked, organization_id: pageState.orgId }),
           });
           if (!res.ok) {
             toggle.checked = !toggle.checked;
@@ -3239,7 +3239,7 @@ <h1>Agents</h1>
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             credentials: 'include',
-            body: JSON.stringify({ interval_hours: parseInt(select.value, 10) }),
+            body: JSON.stringify({ interval_hours: parseInt(select.value, 10), organization_id: pageState.orgId }),
           });
           if (!res.ok) {
             select.value = previousValue;
@@ -3390,6 +3390,7 @@ <h1>Agents</h1>
           method: 'POST',
           credentials: 'include',
           headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ organization_id: pageState.orgId }),
         });
         const data = await res.json().catch(() => ({}));
 
@@ -3449,7 +3450,7 @@ <h1>Agents</h1>
       panel.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
 
       try {
-        const res = await fetch(`/api/registry/agents/${encodeURIComponent(agentUrl)}/monitoring/requests?limit=50`, {
+        const res = await fetch(`/api/registry/agents/${encodeURIComponent(agentUrl)}/monitoring/requests?limit=50&org=${encodeURIComponent(pageState.orgId)}`, {
           credentials: 'include',
         });
         if (!res.ok) throw new Error('Failed to load');

server/public/dashboard-membership.html

@@ -1579,7 +1579,8 @@ <h3>${title}</h3>
     // Load referral banner — shows discount countdown for users who accepted a referral invitation
     async function loadReferralBanner() {
       try {
-        const res = await fetch('/api/me/referral', { credentials: 'include' });
+        if (!currentOrg?.id) return;
+        const res = await fetch('/api/me/referral?org=' + encodeURIComponent(currentOrg.id), { credentials: 'include' });
         if (!res.ok) return;
         const data = await res.json();
         if (!data.referral || data.days_remaining === null) return;

server/public/join.html

@@ -439,9 +439,13 @@ <h1 id="joinHeadline" class="join-headline"></h1>
         if (!config || !config.user) {
           return Promise.resolve({ user: null, existingReferral: null });
         }
-        return fetch('/api/me/referral', { credentials: 'include' })
+        var selectedOrgId = new URLSearchParams(window.location.search).get('org') || localStorage.getItem('selectedOrgId');
+        if (!selectedOrgId) {
+          return Promise.resolve({ user: config.user, existingReferral: null, selectedOrgId: null });
+        }
+        return fetch('/api/me/referral?org=' + encodeURIComponent(selectedOrgId), { credentials: 'include' })
           .then(function (res) { return res.ok ? res.json() : { referral: null }; })
-          .then(function (data) { return { user: config.user, existingReferral: data.referral, daysRemaining: data.days_remaining }; })
+          .then(function (data) { return { user: config.user, existingReferral: data.referral, daysRemaining: data.days_remaining, selectedOrgId: selectedOrgId }; })
           .catch(function () { return { user: config.user, existingReferral: null }; });
       }
 
@@ -533,12 +537,19 @@ <h1 id="joinHeadline" class="join-headline"></h1>
         btn.textContent = 'Accepting...';
 
         var marketingOptIn = document.getElementById('marketingOptIn').checked;
+        var selectedOrgId = new URLSearchParams(window.location.search).get('org') || localStorage.getItem('selectedOrgId');
+        if (!selectedOrgId) {
+          btn.disabled = false;
+          btn.textContent = 'Accept invitation';
+          alert('Select an organization from your dashboard, then reopen this invitation.');
+          return;
+        }
 
         fetch('/api/referral/' + encodeURIComponent(code) + '/accept', {
           method: 'POST',
           credentials: 'include',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ marketing_opt_in: marketingOptIn }),
+          body: JSON.stringify({ marketing_opt_in: marketingOptIn, organization_id: selectedOrgId }),
         })
           .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, status: res.status, body: body }; }); })
           .then(function (r) {

server/public/member-profile.html

@@ -2907,6 +2907,7 @@ <h2>Tags</h2>
         const fd = new FormData();
         fd.append('file', file);
         fd.append('tags', 'primary');
+        fd.append('organization_id', getOrgIdFromUrl() || '');
         const resp = await fetch(`/api/brands/${encodeURIComponent(brandDomain)}/logos`, {
           method: 'POST',
           body: fd,

server/public/my-content.html

@@ -1375,14 +1375,22 @@ <h3 ${isPendingView ? '' : titleAction}>${escapeHtml(item.title)}</h3>
           response = await fetch(`/api/me/content/${id}`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ ...data, status: statusValue })
+            body: JSON.stringify({
+              ...data,
+              status: statusValue,
+              organization_id: localStorage.getItem('selectedOrgId') || '',
+            })
           });
         } else {
           // Create new via propose endpoint
           response = await fetch('/api/content/propose', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ ...data, status: statusValue })
+            body: JSON.stringify({
+              ...data,
+              status: statusValue,
+              organization_id: localStorage.getItem('selectedOrgId') || '',
+            })
           });
         }
 

server/public/onboarding.html

@@ -936,7 +936,7 @@ <h2 style="margin-bottom: var(--space-2);">Set up your brand</h2>
               const domain = currentUser.email ? currentUser.email.split('@')[1] : '';
               document.getElementById('loading').style.display = 'none';
               document.getElementById('mainContent').style.display = 'block';
-              showBrandSetup(companyOrg.name, domain);
+              showBrandSetup(companyOrg.name, domain, companyOrg.id);
               return;
             }
           }
@@ -1547,7 +1547,7 @@ <h2 style="margin-bottom: var(--space-2);">Set up your brand</h2>
         }
 
         // Show brand setup step instead of going directly to dashboard
-        showBrandSetup(orgName, corporateDomain);
+        showBrandSetup(orgName, corporateDomain, data.organization?.id || data.id);
       } catch (error) {
         showError(error.message);
         createBtn.disabled = false;
@@ -1623,9 +1623,11 @@ <h2 style="margin-bottom: var(--space-2);">Set up your brand</h2>
     // ── Brand setup step ──────────────────────────────────────────────
 
     var createdOrgName = '';
+    var createdOrgId = '';
 
-    function showBrandSetup(orgName, domain) {
+    function showBrandSetup(orgName, domain, orgId) {
       createdOrgName = orgName;
+      createdOrgId = orgId || '';
       document.getElementById('createForm').style.display = 'none';
       document.getElementById('brandSetupSection').style.display = 'block';
       document.getElementById('brandDomain').value = domain || '';
@@ -1676,6 +1678,7 @@ <h2 style="margin-bottom: var(--space-2);">Set up your brand</h2>
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({
+            organization_id: createdOrgId,
             domain: domain,
             brand_name: createdOrgName,
             logo_url: logoUrl || undefined,

server/public/property-viewer.html

@@ -738,7 +738,11 @@ <h3>Edit Property</h3>
           const response = await fetch(`/api/properties/hosted/${encodeURIComponent(currentDomain)}`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ edit_summary: editSummary, adagents_json }),
+            body: JSON.stringify({
+              edit_summary: editSummary,
+              adagents_json,
+              organization_id: localStorage.getItem('selectedOrgId') || '',
+            }),
           });
 
           if (!response.ok) {

server/public/video-lab.html

@@ -729,6 +729,7 @@ <h2>Event log</h2>
       // so this user's settings shape this Tavus session only.
       const formSettings = readSettingsFromForm();
       const body = {
+        organization_id: localStorage.getItem('selectedOrgId') || undefined,
         greeting: formSettings.greeting || undefined,
         extraContext: formSettings.extraContext || undefined,
         maxDurationSec: formSettings.durationMin ? formSettings.durationMin * 60 : undefined,

server/public/video.html

@@ -394,7 +394,13 @@ <h2>Start a video conversation</h2>
 
       let conversationUrl;
       try {
-        const res = await fetch('/api/addie/video/session', { method: 'POST' });
+        const organizationId = localStorage.getItem('selectedOrgId');
+        if (!organizationId) throw new Error('Select an organization in the dashboard before starting a call');
+        const res = await fetch('/api/addie/video/session', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ organization_id: organizationId }),
+        });
         if (!res.ok) {
           const data = await res.json().catch(() => ({}));
           throw new Error(data.error || 'Failed to start session');