refactor(auth): drop LOC that did not earn its place

Line-by-line pass over the final diff. No behavior change; every item is either
a comment that had drifted from the code or state the code did not need.

- The create hook's comment claimed a failed membership read still clamps "via
  the cached membership". Since `getMemberOrganizationId` now throws, that only
  holds when the cache is warm. Say what the code actually does: `null` means
  confirmed org-less, `undefined` means could-not-tell, and the catch branches
  on which one it got.
- `isPolicyEnforced(orgId, hasBounds)` took a boolean parameter that inverted
  its own name — it returned `true` for an org with no policy at all. Split
  into a plain early return for the no-bounds case and `isEntitledToEnforce`,
  which now only answers the question its name asks.
- The revoke route aliased a transaction result to rename one field; destructure
  it instead.
- The policy UPDATE returned `id` purely as an existence check that the version
  column it also returns already provides.
- Two test names still described invalidating a cache that is now published to.

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/session-policy/route.ts

@@ -150,10 +150,7 @@ export const PUT = withRouteHandler(
           updatedAt: new Date(),
         })
         .where(eq(organization.id, organizationId))
-        .returning({
-          id: organization.id,
-          securityPolicyVersion: organization.securityPolicyVersion,
-        })
+        .returning({ securityPolicyVersion: organization.securityPolicyVersion })
       if (!row) return null
       await eagerClampOrgSessions(organizationId, merged, tx)
       return row

apps/sim/app/api/organizations/[id]/sessions/revoke/route.test.ts

@@ -149,7 +149,7 @@ describe('org sessions revoke route', () => {
       queueTableRows(organization, [{ name: 'Acme' }])
     })
 
-    it('reports the revoked count, bumps the version, and invalidates the cache', async () => {
+    it('reports the revoked count, bumps the version, and publishes it', async () => {
       dbChainMockFns.returning
         .mockResolvedValueOnce([{ id: 's-1' }, { id: 's-2' }])
         .mockResolvedValueOnce([{ securityPolicyVersion: 5 }])

apps/sim/app/api/organizations/[id]/sessions/revoke/route.ts

@@ -81,7 +81,7 @@ export const POST = withRouteHandler(
     // Delete and version bump commit atomically: a bump failure must roll the
     // delete back, or members would stay authenticated from the cookie cache
     // for up to 24h with their DB sessions already gone.
-    const revokeResult = await db.transaction(async (tx) => {
+    const { revoked, version } = await db.transaction(async (tx) => {
       const deleted = await tx
         .delete(sessionTable)
         .where(
@@ -104,12 +104,9 @@ export const POST = withRouteHandler(
         .set({ securityPolicyVersion: sql`${organization.securityPolicyVersion} + 1` })
         .where(eq(organization.id, organizationId))
         .returning({ securityPolicyVersion: organization.securityPolicyVersion })
-      return { deleted, version: bumped?.securityPolicyVersion }
+      return { revoked: deleted, version: bumped?.securityPolicyVersion }
     })
-    const revoked = revokeResult.deleted
-    if (revokeResult.version !== undefined) {
-      setSecurityPolicyVersion(organizationId, revokeResult.version)
-    }
+    if (version !== undefined) setSecurityPolicyVersion(organizationId, version)
 
     logger.info('Revoked organization sessions', {
       organizationId,

apps/sim/lib/auth/auth.ts

@@ -661,9 +661,10 @@ export const auth = betterAuth({
             }
           }
 
-          // Resolved separately from the clamp below: when this lookup fails we
-          // still clamp (falling back to the cached membership) rather than
-          // minting a full-length session off a transient read error.
+          // Resolved separately from the clamp below so the two failures stay
+          // distinguishable: `null` means "confirmed not in an org", while
+          // `undefined` means "could not tell". The clamp retries through the
+          // membership cache, and the catch below branches on which one it got.
           let membershipOrgId: string | null | undefined
           try {
             const members = await db
@@ -677,7 +678,7 @@ export const auth = betterAuth({
               { userId: session.userId, organizationId: membershipOrgId ?? undefined }
             )
           } catch (error) {
-            logger.error('Error resolving organization for new session; using cached membership', {
+            logger.error('Could not resolve organization for new session', {
               error,
               userId: session.userId,
             })

apps/sim/lib/auth/security-policy.test.ts

@@ -33,7 +33,7 @@ describe('security policy', () => {
   })
 
   describe('getSecurityPolicyVersion', () => {
-    it('caches the version and re-reads after invalidation', async () => {
+    it('caches the version and serves a newly published one without a re-read', async () => {
       const orgId = nextOrgId()
       queueTableRows(organization, [{ version: 3 }])
 

apps/sim/lib/auth/session-policy.ts

@@ -30,11 +30,10 @@ const NO_POLICY: ResolvedSessionPolicy = {
  * downgrade. `isOrganizationOnEnterprisePlan` swallows its errors and returns
  * `false`, which is correct for feature gating (fail closed) but would silently
  * stop ENFORCING here — the fail-open trap the PII-redaction path documents in
- * `lib/logs/execution/logger.ts`. Only reached when bounds are actually stored,
- * so non-enterprise orgs never pay for it.
+ * `lib/logs/execution/logger.ts`. Callers only reach this when bounds are
+ * actually stored, so non-enterprise orgs never pay for it.
  */
-async function isPolicyEnforced(organizationId: string, hasBounds: boolean): Promise<boolean> {
-  if (!hasBounds) return true
+async function isEntitledToEnforce(organizationId: string): Promise<boolean> {
   try {
     return await resolveOrganizationEnterprisePlan(organizationId)
   } catch (error) {
@@ -78,13 +77,15 @@ export async function getSessionPolicy(
     .limit(1)
 
   const settings = row?.settings ?? {}
-  const hasBounds = Boolean(settings.maxSessionHours || settings.idleTimeoutHours)
-  if (!(await isPolicyEnforced(organizationId, hasBounds))) return NO_POLICY
-
-  return {
+  const bounds: ResolvedSessionPolicy = {
     maxSessionHours: settings.maxSessionHours ?? null,
     idleTimeoutHours: settings.idleTimeoutHours ?? null,
   }
+
+  if (!bounds.maxSessionHours && !bounds.idleTimeoutHours) return NO_POLICY
+  if (!(await isEntitledToEnforce(organizationId))) return NO_POLICY
+
+  return bounds
 }
 
 /**