Fix API token expiration and org member getOrganization access

[andrei-radulescu-banu]

Summary

• Enforce API access token lifetime during authentication: tokens past created_at + lifetime days are rejected with 401 (API token expired). lifetime of 0 still means no expiration.
• Allow non-admin org members to fetch their organization via GET /v0/account/organizations?organization_id=… (fixes getOrganization() 403 for regular members).

Test plan

• pytest packages/python/tests/test_access_tokens.py — includes new test_expired_access_token_rejected
• pytest packages/python/tests/test_org_permissions.py — includes new test_org_member_can_get_organization_by_id
• Verify org member can load document sidebar org settings (default_prompt_enabled) without console 403
• Verify expired org API token cannot call org endpoints

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • API tokens now expire as expected, and expired tokens are rejected with a clear authentication error.
  • Organization details can now be viewed by any valid organization member, not just admins.
• Tests
  • Added coverage for expired token rejection.
  • Added coverage for organization members accessing their own organization.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a token expiration check (is_access_token_expired) enforced in get_current_user and get_org_id_from_token, rejecting expired API tokens with HTTP 401. Changes list_organizations authorization from organization-admin to organization-member checks. Adds corresponding tests for both behaviors.

Changes

Access token expiry and org authorization

Layer / File(s)	Summary
Token expiry helper and enforcement packages/python/app/auth.py	Adds is_access_token_expired to compute expiry from token lifetime and creation timestamp, and enforces it in get_current_user and get_org_id_from_token, raising 401 "API token expired" when expired.
Organization list membership authorization packages/python/app/routes/orgs.py	Replaces organization-admin check with system-admin-or-organization-member check for viewing an organization by organization_id, returning 403 when unauthorized.
Test coverage for expiry and membership access packages/python/tests/test_access_tokens.py, packages/python/tests/test_org_permissions.py	Adds a test that backdates a token to simulate expiry and verifies 401 rejection, and a test confirming a non-admin org member can retrieve their organization.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AuthDependency as get_current_user/get_org_id_from_token
  participant TokenStore as access_tokens collection
  Client->>AuthDependency: Request with API token
  AuthDependency->>TokenStore: Fetch stored_token
  AuthDependency->>AuthDependency: is_access_token_expired(stored_token)
  AuthDependency-->>Client: 401 "API token expired" (if expired)
  AuthDependency-->>Client: Proceed with request (if not expired)

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two main changes: token expiration enforcement and org member organization access.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/token-expiry-and-org-member-access

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/python/app/auth.py`:
- Line 4: The import in auth.py is using datetime.UTC, which is not compatible
with the declared Python 3.9/3.10 support. Update the auth module to use
timezone.utc instead, and make the same timezone import/value change in the
matching tests that reference this constant so the code imports and runs
correctly on all supported versions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ac0e1d23-271b-4e6c-a822-5ff7435431fa

📥 Commits

Reviewing files that changed from the base of the PR and between df42da0 and 300fb5a.

📒 Files selected for processing (4)

• packages/python/app/auth.py
• packages/python/app/routes/orgs.py
• packages/python/tests/test_access_tokens.py
• packages/python/tests/test_org_permissions.py

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check declared Python version constraints
fd -a pyproject.toml packages/python | xargs -I{} sh -c 'echo "== {} =="; rg -n "requires-python|python_requires|target-version" {}'
fd -a '.python-version|.tool-versions' 2>/dev/null | xargs -I{} sh -c 'echo "== {} =="; cat {}'
rg -n "python" packages/python/setup.cfg packages/python/setup.py 2>/dev/null | rg -i "version|require"

Repository: analytiq-hub/doc-router

Length of output: 364

---

Use timezone.utc for Python 3.9/3.10 compatibility
packages/python/pyproject.toml declares requires-python = ">=3.9", but datetime.UTC is only available in Python 3.11+. This will fail at import time on supported runtimes; switch to timezone.utc here and in the matching tests.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/python/app/auth.py` at line 4, The import in auth.py is using
datetime.UTC, which is not compatible with the declared Python 3.9/3.10 support.
Update the auth module to use timezone.utc instead, and make the same timezone
import/value change in the matching tests that reference this constant so the
code imports and runs correctly on all supported versions.