feat: expose My Organization user permissions claim in session for UI…

[Piyush-85]

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

📋 Changes

• The My Organization API will inject a urn:auth0:my_org_current_user_permissions claim into the ID token containing the user's effective my_org:* permissions in their current organization.
• In RWA mode the raw ID token never reaches the browser, filterDefaultIdTokenClaims controls what lands in session.user and useUser()
• The claim was not in the hardcoded allowlist and would have been silently stripped
• Added urn:auth0:my_org_current_user_permissions to DEFAULT_ID_TOKEN_CLAIMS, no consumer configuration required, same behaviour as org_id
• Added "urn:auth0:my_org_current_user_permissions"?: string[] to the User type in src/types/index.ts
• Added "Reading Organization Permissions" section to EXAMPLES.md with Server Component and Client Component usage patterns, and added the claim to the default claims list

🎯 Testing

• Unit tests in src/server/user.test.ts cover: claim retained with populated array, claim retained with empty array, claim coexists with all standard claims, unrecognised custom claims still filtered
• After login, verify session.user["urn:auth0:my_org_current_user_permissions"] contains the array

Summary by CodeRabbit

• New Features

  • Added access to current-organization permissions through user ID-token claims.
  • Organization permissions are available in the user profile for permission-based UI decisions.

• Documentation

  • Added Server and Client Component examples for reading and using organization permissions.
  • Clarified that permissions are cached in the encrypted session and do not replace server-side API authorization.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c5c985e-6552-47a3-ac59-703bb28c93b7

📥 Commits

Reviewing files that changed from the base of the PR and between 56a83d6 and 9d0e1be.

📒 Files selected for processing (1)

• EXAMPLES.md

🚧 Files skipped from review as they are similar to previous changes (1)

• EXAMPLES.md

---

📝 Walkthrough

Walkthrough

The SDK exposes the current-organization permissions claim on User, preserves it during ID-token filtering, tests its handling, and documents Server and Client Component usage.

Changes

Organization permissions claim

Layer / File(s)	Summary
Claim typing and filtering src/types/index.ts, src/server/user.ts, src/server/user.test.ts	The User interface and default ID-token claim list include urn:auth0:my_org_current_user_permissions. Tests cover populated and empty arrays, standard claims, timestamp removal, and custom claim filtering.
Claim examples and reference EXAMPLES.md	Examples show permission-based UI gating in Server and Client Components. The documentation lists the claim as a default user claim and states that API authorization remains server-enforced.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: amitsingh05667

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes exposing the My Organization user permissions claim in the session for UI authorization.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/my-org-permissions-claim

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.99%. Comparing base (0198c30) to head (9d0e1be).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2798   +/-   ##
=======================================
  Coverage   87.98%   87.99%           
=======================================
  Files          80       80           
  Lines       11515    11516    +1     
  Branches     2386     2386           
=======================================
+ Hits        10132    10133    +1     
  Misses       1338     1338           
  Partials       45       45           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@EXAMPLES.md`:
- Around line 3722-3725: Define `InviteMemberButton` within the Server Component
example or add an application-specific import for it, ensuring the `canInvite`
conditional renders a valid, available element when readers copy the example.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4582668c-9e01-409f-91b5-4cc98232ca0d

📥 Commits

Reviewing files that changed from the base of the PR and between ce2ac00 and 56a83d6.

📒 Files selected for processing (4)

• EXAMPLES.md
• src/server/user.test.ts
• src/server/user.ts
• src/types/index.ts