astronomer / astro-cli / 38993389548

45%

Build Type

push

github

Committed by web-flow

Commit Message

fix(otto): preflight org membership before launching Otto (AI-992) (#2208)

* fix(otto): preflight org membership before launching Otto (AI-992)

`astro otto` could spawn Otto with a token whose user isn't a member of
ASTRO_ORGANIZATION — e.g. a stale ASTRO_ORGANIZATION export, or an org
selected under a different login. The mismatch was invisible at launch (the
LLM gateway isn't RBAC-gated) and only surfaced later as a confusing
"403: organization <id> is forbidden" on the first org-scoped call (hosted
skills).

Add a launch-time membership preflight in pkg/otto:

- Resolve the effective org the way BuildEnv does (context org, else the
  inherited ASTRO_ORGANIZATION that passes through when the context org is
  empty) and call GetOrganization with the current token.
- On a definitive 403/404, fail fast with actionable guidance that names the
  signed-in user (astro login / astro organization switch / clear a stale
  export), and exit quietly like ErrNotLoggedIn.
- Fail CLOSED only on 403/404; any transient or inconclusive outcome
  (request error, 5xx, unexpected shape) lets the launch proceed so the
  preflight can never become a new way for `astro otto` to break.

Adds pkg/otto/preflight_test.go covering member/403/404, the inherited-env
org path, self-user lookup failure, skip-when-no-org/token, and fail-open.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Never block an API token, bound the preflight, and name the org's source

- A 403/404 blocks only a login the self-user lookup can name. An API
  token reaches an organization by its own grants rather than
  membership, so a workspace- or deployment-scoped token that cannot
  read its organization is no longer locked out of Otto. A self-user
  lookup that fails now lets the launch proceed instead of blocking
  with a generic subject.
- Both calls run under a 5s deadline instead of the HTTP client's 30s,
  and the preflight is skipped for --help and --version, which need no
  organiz... (continued)

Coverage Stats

46 of 58 new or added lines in 3 files covered. (79.31%)

1 existing line in 1 file now uncovered.

27184 of 60352 relevant lines covered (45.04%)

9.8 hits per line