mrhid6
77a92787fb
Findings from the final whole-branch review. - scopedCollections named "audit" and "channels", but the code writes to audit_logs and notification_channels. On upgrade from single-tenant, legacy audit events and channels would never get org_id, becoming invisible to org-filtered reads while channels silently stopped firing — and the detection loop counted the wrong names, so the 0001 marker could be written having migrated nothing. Names fixed, plus migration 0003 so an incorrectly-migrated instance converges with a fresh one. - EnsureAuthIndexes failure is now fatal. GetUserByEmail is unscoped and the OIDC cross-org guard compares against whichever duplicate Mongo returns first, so users.email uniqueness is a security invariant, and a legacy collection with duplicate emails is the realistic upgrade case. - Evict the per-org OIDC provider cache on save; rotating away from a compromised IdP previously had no effect until restart. - Build the oauth2 config per request instead of mutating a shared cached pointer outside the mutex, which raced on RedirectURL between concurrent logins for the same org. - Stamp org_id on console_sessions, incidents and monitor_rollups, the last collections with no tenant column. 0003 derives their org from the owning server/monitor rather than defaulting, so one org's console history and incident timeline cannot merge into another's. - Seed default steps when an org is created, not only at boot. - Reject an empty session OrgID at the middleware. - Derive the app root label from APP_ROOT_LABEL instead of hardcoding "vantage", which silently disabled the host guard off that domain. - Stop caching negative slug lookups, so a new org's subdomain resolves immediately.