fix(auth): make org session policy and cookie-cache version cache-coherent

The session-policy enforcement added in #5862 split an org's
`securityPolicyVersion` and `sessionPolicySettings` across two independent
process-local caches. On a multi-replica deployment a pod could observe the
bumped version while still holding the pre-save policy, and that skew silently
undid a just-saved tightening:

1. Saving a policy eagerly clamps every member session in SQL. Shortening
   `expires_at` makes Better Auth's refresh predicate
   (`expiresAt - expiresIn + updateAge <= now`) unconditionally true, so the
   save itself marks the whole org due for refresh.
2. The version bump expires the session-data cookie, forcing the DB path.
3. The refresh proposes `now + 30d` and `session.update.before` re-clamps it —
   but against the stale policy, so it passed through unclamped.
4. With `expiresAt` back at 30 days the predicate is false again, so nothing
   re-clamped that session for another ~24h.

Both fields live on the same `organization` row, so they are now read and
cached as one record: a pod that still sees version N also serves policy N and
forces no cookie mismatch, removing the skew by construction rather than
patching one direction of it. Session CREATE additionally reads through the
cache — unlike a refresh it is not already preceded by a version-mismatch read,
so a stale record would otherwise mint a full-length session.

Also in this change:

- A failed entitlement read no longer disables enforcement. Stored bounds are
  only writable by an entitled org, so their presence is the source of truth
  when the plan check is unavailable; `resolveOrganizationEnterprisePlan`
  propagates errors so "downgraded" and "check failed" stay distinguishable.
  This matches the reasoning already documented on the PII-redaction path.
- A failed org-record read serves the last known-good record instead of
  falling back to defaults, which would have dropped the org's bounds entirely.
- A failed membership lookup in `session.create.before` no longer skips the
  clamp; it falls back to the cached membership.
- Both caches are bounded (expired entries first, then least-recently-refreshed)
  — they previously grew one entry per distinct org/user for the process life.
- The cookie-cache version fn short-circuits when organizations are disabled,
  so those deployments pay no lookup on the authenticated hot path.
- Idle-timeout copy now states the real guarantee: activity is recorded at most
  once per 24h, so sign-out lands between (value - 24) and (value) hours after
  last use, never later.

Tests: new coverage for the org-record collapse, last-known-good behavior,
entitlement failure, the impersonation exemption, and the previously untested
revoke route (authz branches, self-token and impersonator exclusions).

Author: waleedlatif1

apps/docs/content/docs/en/platform/enterprise/session-policies.mdx

@@ -27,7 +27,9 @@ Use this to enforce periodic re-authentication — for example, a value of `168`
 
 ### Idle timeout
 
-Signs a member out after this many hours without activity. Activity extends the session, so members who use Sim regularly stay signed in; dormant sessions expire.
+Signs a member out after a period without activity. Activity extends the session, so members who use Sim regularly stay signed in; dormant sessions expire.
+
+Activity is recorded at most once per 24 hours, so the actual sign-out lands between (value − 24) and (value) hours after a member's last use — never later. A value of `48` means a dormant session ends somewhere between 24 and 48 hours after last activity.
 
 Accepts 48 to 8760 hours. The 48-hour minimum exists because session activity is recorded at most once per day — a shorter window could sign out members who are actively working.
 
@@ -72,5 +74,10 @@ Use this after a security incident, an offboarding wave, or before tightening a
       answer:
         'Session activity is recorded at most once per 24 hours for performance. The minimum is twice that window so a member who stays active always registers activity before the idle limit can expire their session.',
     },
+    {
+      question: 'Why was a member signed out earlier than the idle timeout I set?',
+      answer:
+        'Because activity is recorded at most once per 24 hours, the last recorded activity can be up to a day older than a member\'s actual last use. Sign-out therefore lands between (value − 24) and (value) hours after they stop working. It never lands later than the value you set, so the policy is never exceeded.',
+    },
   ]}
 />

apps/sim/app/api/organizations/[id]/session-policy/route.test.ts

@@ -21,11 +21,10 @@ const { mockIsEnterprise, mockEagerClamp, mockRecordAudit } = vi.hoisted(() => (
 
 vi.mock('@/lib/auth/session-policy', () => ({
   eagerClampOrgSessions: mockEagerClamp,
-  invalidateSessionPolicyCache: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/security-policy', () => ({
-  invalidateSecurityPolicyVersionCache: vi.fn(),
+  invalidateOrgSecurityCache: vi.fn(),
 }))
 
 vi.mock('@/lib/billing/core/subscription', () => ({

apps/sim/app/api/organizations/[id]/session-policy/route.ts

@@ -9,8 +9,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { updateOrganizationSessionPolicyContract } from '@/lib/api/contracts/organization'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { invalidateSecurityPolicyVersionCache } from '@/lib/auth/security-policy'
-import { eagerClampOrgSessions, invalidateSessionPolicyCache } from '@/lib/auth/session-policy'
+import { invalidateOrgSecurityCache } from '@/lib/auth/security-policy'
+import { eagerClampOrgSessions } from '@/lib/auth/session-policy'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -160,8 +160,7 @@ export const PUT = withRouteHandler(
       return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
     }
 
-    invalidateSessionPolicyCache(organizationId)
-    invalidateSecurityPolicyVersionCache(organizationId)
+    invalidateOrgSecurityCache(organizationId)
 
     logger.info('Updated organization session policy', { organizationId })
 

apps/sim/app/api/organizations/[id]/sessions/revoke/route.test.ts

@@ -0,0 +1,231 @@
+/**
+ * @vitest-environment node
+ */
+import { member, organization, session as sessionTable } from '@sim/db/schema'
+import {
+  authMockFns,
+  createMockRequest,
+  dbChainMockFns,
+  queueTableRows,
+  resetDbChainMock,
+  resetEnvFlagsMock,
+  setEnvFlags,
+} from '@sim/testing'
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockIsEnterprise, mockRecordAudit, mockInvalidateOrgSecurityCache } = vi.hoisted(() => ({
+  mockIsEnterprise: vi.fn(),
+  mockRecordAudit: vi.fn(),
+  mockInvalidateOrgSecurityCache: vi.fn(),
+}))
+
+vi.mock('@/lib/auth/security-policy', () => ({
+  invalidateOrgSecurityCache: mockInvalidateOrgSecurityCache,
+}))
+
+vi.mock('@/lib/billing/core/subscription', () => ({
+  isOrganizationOnEnterprisePlan: mockIsEnterprise,
+}))
+
+vi.mock('@sim/audit', () => ({
+  recordAudit: mockRecordAudit,
+  AuditAction: { ORGANIZATION_SESSIONS_REVOKED: 'organization.sessions.revoked' },
+  AuditResourceType: { ORGANIZATION: 'organization' },
+}))
+
+import { POST } from '@/app/api/organizations/[id]/sessions/revoke/route'
+
+const mockGetSession = authMockFns.mockGetSession
+
+const ORG_ID = 'org-1'
+const CALLER_TOKEN = 'tok-caller'
+const routeContext = { params: Promise.resolve({ id: ORG_ID }) }
+
+interface MockCondition {
+  type: string
+  left?: unknown
+  right?: unknown
+  column?: unknown
+  conditions?: MockCondition[]
+}
+
+/** Flattens the nested `and(...)` the route builds into a flat condition list. */
+function flattenConditions(condition: MockCondition): MockCondition[] {
+  if (condition.type !== 'and') return [condition]
+  return (condition.conditions ?? []).flatMap(flattenConditions)
+}
+
+/**
+ * The condition list passed to the session DELETE's `.where(...)`. Identified by
+ * its `inArray` over `session.user_id` rather than by call position, since the
+ * version-bump UPDATE issues its own `.where(...)` on the same shared spy.
+ */
+function deleteConditions(): MockCondition[] {
+  expect(dbChainMockFns.delete).toHaveBeenCalledWith(sessionTable)
+  const match = dbChainMockFns.where.mock.calls
+    .map(([arg]) => flattenConditions(arg as MockCondition))
+    .find((conditions) =>
+      conditions.some(
+        (condition) => condition.type === 'inArray' && condition.column === sessionTable.userId
+      )
+    )
+  expect(match).toBeDefined()
+  return match as MockCondition[]
+}
+
+function authenticateAs(overrides: Record<string, unknown> = {}) {
+  mockGetSession.mockResolvedValue({
+    user: { id: 'user-1', name: 'Admin', email: 'admin@acme.dev' },
+    session: { token: CALLER_TOKEN, ...overrides },
+  })
+}
+
+beforeAll(() => {
+  setEnvFlags({ isBillingEnabled: true })
+})
+
+afterAll(resetEnvFlagsMock)
+
+describe('org sessions revoke route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    authenticateAs()
+    mockIsEnterprise.mockResolvedValue(true)
+  })
+
+  describe('authorization', () => {
+    it('returns 401 when unauthenticated', async () => {
+      mockGetSession.mockResolvedValue(null)
+      const response = await POST(createMockRequest('POST'), routeContext)
+      expect(response.status).toBe(401)
+      expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    })
+
+    it('returns 403 for non-members', async () => {
+      queueTableRows(member, [])
+      const response = await POST(createMockRequest('POST'), routeContext)
+      expect(response.status).toBe(403)
+      expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    })
+
+    it('returns 403 for members without an admin role', async () => {
+      queueTableRows(member, [{ role: 'member' }])
+      const response = await POST(createMockRequest('POST'), routeContext)
+      expect(response.status).toBe(403)
+      expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    })
+
+    it('returns 403 for non-enterprise organizations', async () => {
+      queueTableRows(member, [{ role: 'owner' }])
+      mockIsEnterprise.mockResolvedValue(false)
+      const response = await POST(createMockRequest('POST'), routeContext)
+      expect(response.status).toBe(403)
+      expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    })
+
+    it('returns 404 when the organization does not exist', async () => {
+      queueTableRows(member, [{ role: 'owner' }])
+      queueTableRows(organization, [])
+      const response = await POST(createMockRequest('POST'), routeContext)
+      expect(response.status).toBe(404)
+      expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    })
+
+    it('allows admins as well as owners', async () => {
+      queueTableRows(member, [{ role: 'admin' }])
+      queueTableRows(organization, [{ name: 'Acme' }])
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: 's-1' }])
+      const response = await POST(createMockRequest('POST'), routeContext)
+      expect(response.status).toBe(200)
+    })
+  })
+
+  describe('revocation', () => {
+    beforeEach(() => {
+      queueTableRows(member, [{ role: 'owner' }])
+      queueTableRows(organization, [{ name: 'Acme' }])
+    })
+
+    it('reports the revoked count, bumps the version, and invalidates the cache', async () => {
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: 's-1' }, { id: 's-2' }])
+
+      const response = await POST(createMockRequest('POST'), routeContext)
+
+      expect(response.status).toBe(200)
+      expect(await response.json()).toEqual({ success: true, data: { revokedSessions: 2 } })
+      expect(dbChainMockFns.set).toHaveBeenCalledWith(
+        expect.objectContaining({ securityPolicyVersion: expect.anything() })
+      )
+      expect(mockInvalidateOrgSecurityCache).toHaveBeenCalledWith(ORG_ID)
+      expect(mockRecordAudit).toHaveBeenCalledWith(
+        expect.objectContaining({
+          action: 'organization.sessions.revoked',
+          resourceId: ORG_ID,
+          metadata: { revokedSessions: 2 },
+        })
+      )
+    })
+
+    it("never deletes the caller's own session", async () => {
+      dbChainMockFns.returning.mockResolvedValueOnce([])
+      await POST(createMockRequest('POST'), routeContext)
+
+      expect(deleteConditions()).toContainEqual(
+        expect.objectContaining({ type: 'ne', right: CALLER_TOKEN })
+      )
+    })
+
+    it('spares impersonation sessions', async () => {
+      dbChainMockFns.returning.mockResolvedValueOnce([])
+      await POST(createMockRequest('POST'), routeContext)
+
+      expect(deleteConditions()).toContainEqual(
+        expect.objectContaining({ type: 'isNull', column: sessionTable.impersonatedBy })
+      )
+    })
+
+    it('scopes the delete to members of the organization', async () => {
+      dbChainMockFns.returning.mockResolvedValueOnce([])
+      await POST(createMockRequest('POST'), routeContext)
+
+      expect(deleteConditions()).toContainEqual(
+        expect.objectContaining({ type: 'inArray', column: sessionTable.userId })
+      )
+    })
+
+    it("also spares the impersonator's own sessions when the caller is impersonating", async () => {
+      authenticateAs({ impersonatedBy: 'platform-admin-1' })
+      dbChainMockFns.returning.mockResolvedValueOnce([])
+
+      await POST(createMockRequest('POST'), routeContext)
+
+      expect(deleteConditions()).toContainEqual(
+        expect.objectContaining({
+          type: 'ne',
+          left: sessionTable.userId,
+          right: 'platform-admin-1',
+        })
+      )
+    })
+
+    it('adds no impersonator exclusion for an ordinary caller', async () => {
+      dbChainMockFns.returning.mockResolvedValueOnce([])
+      await POST(createMockRequest('POST'), routeContext)
+
+      const userIdExclusions = deleteConditions().filter(
+        (condition) => condition.type === 'ne' && condition.left === sessionTable.userId
+      )
+      expect(userIdExclusions).toHaveLength(0)
+    })
+
+    it('singularizes the audit description for a single session', async () => {
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: 's-1' }])
+      await POST(createMockRequest('POST'), routeContext)
+
+      expect(mockRecordAudit).toHaveBeenCalledWith(
+        expect.objectContaining({ description: 'Revoked 1 member session' })
+      )
+    })
+  })
+})

apps/sim/app/api/organizations/[id]/sessions/revoke/route.ts

@@ -8,7 +8,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { revokeOrganizationSessionsContract } from '@/lib/api/contracts/organization'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { invalidateSecurityPolicyVersionCache } from '@/lib/auth/security-policy'
+import { invalidateOrgSecurityCache } from '@/lib/auth/security-policy'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -105,7 +105,7 @@ export const POST = withRouteHandler(
         .where(eq(organization.id, organizationId))
       return deleted
     })
-    invalidateSecurityPolicyVersionCache(organizationId)
+    invalidateOrgSecurityCache(organizationId)
 
     logger.info('Revoked organization sessions', {
       organizationId,

apps/sim/ee/session-policy/components/session-policy-settings.tsx

@@ -190,7 +190,7 @@ export function SessionPolicySettings({ organizationId }: SessionPolicySettingsP
           <HourField
             id='idle-timeout-hours'
             title='Idle timeout (hours)'
-            hint={`Sessions expire after this many hours without activity. Minimum ${MIN_IDLE_TIMEOUT_HOURS} hours.`}
+            hint={`Sessions expire within this many hours of a member's last activity. Activity is recorded at most once per 24 hours, so members may be signed out up to a day earlier than the value you set — never later. Minimum ${MIN_IDLE_TIMEOUT_HOURS} hours.`}
             value={idleTimeoutHours}
             onChange={setIdleTimeoutHours}
           />

apps/sim/lib/auth/auth.ts

@@ -661,40 +661,54 @@ export const auth = betterAuth({
             }
           }
 
+          // Resolved separately from the clamp below: when this lookup fails we
+          // still clamp (falling back to the cached membership) rather than
+          // minting a full-length session off a transient read error.
+          let membershipOrgId: string | null | undefined
           try {
-            // Find the first organization this user is a member of
             const members = await db
               .select({ organizationId: schema.member.organizationId })
               .from(schema.member)
               .where(eq(schema.member.userId, session.userId))
               .limit(1)
-
-            if (members.length > 0) {
-              logger.info('Found organization for user', {
-                userId: session.userId,
-                organizationId: members[0].organizationId,
-              })
-
-              const expiresAt = await clampExpiryForSession(session, members[0].organizationId)
-
-              return {
-                data: {
-                  ...session,
-                  expiresAt,
-                  activeOrganizationId: members[0].organizationId,
-                },
-              }
-            }
-            logger.info('No organizations found for user', {
+            membershipOrgId = members[0]?.organizationId ?? null
+            logger.info(
+              membershipOrgId ? 'Found organization for user' : 'No organizations found for user',
+              { userId: session.userId, organizationId: membershipOrgId ?? undefined }
+            )
+          } catch (error) {
+            logger.error('Error resolving organization for new session; using cached membership', {
+              error,
               userId: session.userId,
             })
-            return { data: session }
+            membershipOrgId = undefined
+          }
+
+          try {
+            // Session creation is rare and, unlike a sliding refresh, is not
+            // already preceded by a cookie-version mismatch read — so it must
+            // read the policy fresh or a just-tightened policy could be missed
+            // for the life of the session.
+            const expiresAt = await clampExpiryForSession(session, membershipOrgId, {
+              bypassPolicyCache: true,
+            })
+            return {
+              data: {
+                ...session,
+                expiresAt,
+                ...(membershipOrgId ? { activeOrganizationId: membershipOrgId } : {}),
+              },
+            }
           } catch (error) {
-            logger.error('Error setting active organization', {
+            logger.error('Error clamping new session to org policy', {
               error,
               userId: session.userId,
             })
-            return { data: session }
+            return {
+              data: membershipOrgId
+                ? { ...session, activeOrganizationId: membershipOrgId }
+                : session,
+            }
           }
         },
       },