fix: expose safe organization lookup error codes in session responses

src/org-context.js

@@ -6,6 +6,20 @@ const text = (value) => typeof value === 'string' ? value.trim() : '';
 const truthy = (value) => value === true || value === 1 || value === '1' || value === 'true';
 const kind = (node) => text(node.orgUnitType || node.type).toUpperCase();
 const isCompany = (node) => kind(node) === 'COMPANY' || text(node.type).toUpperCase() === 'COMPANY';
+const safeErrors = new Set([
+  'org_context_missing_credentials', 'org_context_invalid_endpoint', 'org_context_invalid_mode',
+  'org_context_invalid_exposure', 'org_context_invalid_tenants', 'org_context_invalid_ttl',
+  'org_context_invalid_timeout', 'org_context_invalid_tenant', 'org_context_invalid_members',
+  'org_context_invalid_member', 'org_context_invalid_children', 'org_context_invalid_response',
+  'org_context_conflicting_tenant', 'org_context_conflicting_membership', 'org_context_cycle',
+  'org_context_scope_mismatch', 'org_context_members_missing', 'org_context_timeout',
+  'org_context_request_failed'
+]);
+
+function safeErrorCode(error) {
+  const code = error?.message;
+  return safeErrors.has(code) || /^org_context_http_[1-5]\d{2}$/.test(code || '') ? code : 'org_context_unavailable';
+}
 
 export function orgContextConfig(env) {
   if (!truthy(env.ORG_CONTEXT_ENABLED)) return null;
@@ -171,13 +185,15 @@ export async function getOrgDirectory(env, { fetchImpl = fetch, now = Date.now,
 
 export async function enrichUserOrganization(user, env, options) {
   if (!user || !truthy(env.ORG_CONTEXT_ENABLED)) return user;
+  const profile = { ...user };
+  delete profile.orgContextError;
   try {
     const directory = await getOrgDirectory(env, options);
     const organization = resolveUserOrganization(directory, user);
-    if (organization.status !== 'resolved') return { ...user, orgContextStatus: organization.status };
+    if (organization.status !== 'resolved') return { ...profile, orgContextStatus: organization.status };
     // Authentication/ownership identifiers and roles are deliberately preserved.
     return {
-      ...user,
+      ...profile,
       company: organization.company || user.company || '',
       companySource: organization.company ? 'org-context' : user.companySource,
       department: organization.department || user.department || '',
@@ -191,7 +207,8 @@ export async function enrichUserOrganization(user, env, options) {
     };
   } catch (error) {
     // Do not log an upstream body, request headers, or a directory containing personal data.
-    console.error(/^org_context_[a-z0-9_]+$/.test(error?.message || '') ? error.message : 'org_context_unavailable');
-    return { ...user, orgContextStatus: 'unavailable' };
+    const code = safeErrorCode(error);
+    console.error(code);
+    return { ...profile, orgContextStatus: 'unavailable', orgContextError: code };
   }
 }