fix IDOR cross organization PROJECT_GET

[0xcucumbersalad]

What is this contribution about?

This PR fixes a cross-organization access control issue in the GET project endpoint.

Previously, it was possible to retrieve project data across organizations by manipulating identifiers, without properly validating that the authenticated user belonged to the same organization as the requested project. This created a potential authorization bypass / cross-tenant data exposure risk.

Changes made:

• Added strict organization scoping when fetching projects.
• Added proper authorization checks before returning project data.

Why this is needed:

Mesh is a multi-tenant system. Allowing cross-organization access breaks tenant isolation and may lead to sensitive data exposure. This fix enforces proper tenant boundaries and strengthens overall security.

---

Summary by cubic

Fix cross-organization access in the GET project tool by scoping lookups to the authenticated organization. Prevents IDOR and cross-tenant data exposure.

• Bug Fixes
  • Removed organizationId from input and use the current session org (ctx.organization.id) for slug lookups; fixed a formatting test.
  • Throw a clear error when organization context is missing to prevent insecure cross-org lookups.

^{Written for commit e5a78e1. Summary will update on new commits.}

[github-actions]

Release Options

Should a new version be published when this PR is merged?

React with an emoji to vote on the release type:

Reaction	Type	Next Version
👍	Prerelease	2.114.2-alpha.1
🎉	Patch	2.114.2
❤️	Minor	2.115.0
🚀	Major	3.0.0

Current version: 2.114.1

Deployment

• Deploy to production (triggers ArgoCD sync after Docker image is published)

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[cubic-dev-ai]

No issues found across 1 file

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/src/tools/projects/get.ts">

<violation number="1" location="apps/mesh/src/tools/projects/get.ts:55">
P2: Non-null assertion on ctx.organization can throw when authenticated context lacks organization scope; requireAuth doesn’t guarantee organization is set.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}