@agent-native/core 0.81.1 → 0.81.2

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2043
-- template files: 4801
+- template files: 4803

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @agent-native/core
 
+## 0.81.2
+
+### Patch Changes
+
+- ea1cc47: Keep OAuth state and environment status checks aligned with scoped workspace credentials.
+
 ## 0.81.1
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.81.1",
+  "version": "0.81.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/server/core-routes-plugin.ts

@@ -2316,11 +2316,10 @@ export function createCoreRoutesPlugin(
             }
             return Promise.all(
               envKeys.map(async (cfg) => {
-                const configured =
-                  Boolean(process.env[cfg.key]) ||
-                  (await runWithRequestContext({ userEmail, orgId }, () =>
-                    resolveSecret(cfg.key).then(Boolean),
-                  ));
+                const configured = await runWithRequestContext(
+                  { userEmail, orgId },
+                  () => resolveSecret(cfg.key).then(Boolean),
+                );
                 return {
                   key: cfg.key,
                   label: cfg.label,

package/corpus/core/src/server/create-server.ts

@@ -221,11 +221,9 @@ export function createServer(
             key: cfg.key,
             label: cfg.label,
             required: cfg.required ?? false,
-            configured:
-              Boolean(process.env[cfg.key]) ||
-              (await runWithRequestContext({ userEmail, orgId }, () =>
-                resolveSecret(cfg.key).then(Boolean),
-              )),
+            configured: await runWithRequestContext({ userEmail, orgId }, () =>
+              resolveSecret(cfg.key).then(Boolean),
+            ),
             ...(cfg.helpText ? { helpText: cfg.helpText } : {}),
           })),
         );

package/corpus/core/src/server/google-oauth.ts

@@ -442,6 +442,7 @@ export function resolveOAuthRedirectUri(
 export interface OAuthStatePayload {
   redirectUri: string;
   owner?: string;
+  orgId?: string;
   desktop?: boolean;
   addAccount?: boolean;
   app?: string;
@@ -512,6 +513,7 @@ function getStateSigningKey(): string {
 export interface EncodeOAuthStateOptions {
   redirectUri: string;
   owner?: string;
+  orgId?: string;
   desktop?: boolean;
   addAccount?: boolean;
   app?: string;
@@ -585,6 +587,7 @@ export function encodeOAuthState(
     r: opts.redirectUri,
   };
   if (opts.owner) payload.o = opts.owner;
+  if (opts.orgId) payload.g = opts.orgId;
   if (opts.desktop) payload.d = true;
   if (opts.addAccount) payload.a = true;
   if (opts.app) payload.app = opts.app;
@@ -631,6 +634,7 @@ export function decodeOAuthState(
       return {
         redirectUri: parsed.r || fallbackUri,
         owner: parsed.o || undefined,
+        orgId: typeof parsed.g === "string" ? parsed.g : undefined,
         desktop: !!parsed.d,
         addAccount: !!parsed.a,
         app: typeof parsed.app === "string" ? parsed.app : undefined,

package/corpus/templates/calendar/actions/create-event.ts

@@ -1,6 +1,10 @@
 import { defineAction } from "@agent-native/core";
 import { emit } from "@agent-native/core/event-bus";
-import { getRequestUserEmail, buildDeepLink } from "@agent-native/core/server";
+import {
+  buildDeepLink,
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
 import { z } from "zod";
 
 import { prepareZoomMeetingPatch } from "../server/lib/event-video-conferencing.js";
@@ -151,7 +155,10 @@ export default defineAction({
     // Resolve account email
     let acctEmail = email;
     if (args.accountEmail && args.accountEmail !== email) {
-      const status = await googleCalendar.getAuthStatus(email);
+      const status = await googleCalendar.getAuthStatus(
+        email,
+        getRequestOrgId(),
+      );
       const isOwned = status.accounts.some(
         (a) => a.email === args.accountEmail,
       );

package/corpus/templates/calendar/actions/event-action-helpers.ts

@@ -1,4 +1,7 @@
-import { getRequestUserEmail } from "@agent-native/core/server";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
 import { z } from "zod";
 
 import * as googleCalendar from "../server/lib/google-calendar.js";
@@ -71,7 +74,10 @@ export async function resolveOwnedAccountEmail(
   requestedAccountEmail: string | undefined,
   ownerEmail: string,
 ): Promise<string> {
-  const status = await googleCalendar.getAuthStatus(ownerEmail);
+  const status = await googleCalendar.getAuthStatus(
+    ownerEmail,
+    getRequestOrgId(),
+  );
   if (!requestedAccountEmail) {
     if (status.accounts.length === 1) {
       return status.accounts[0].email;

package/corpus/templates/calendar/app/components/calendar/GoogleConnectBanner.tsx

@@ -189,6 +189,17 @@ export function GoogleConnectBanner({
     }
   }, [authUrl.error, fetchStatus]);
 
+  useEffect(() => {
+    if (
+      desktopAuthIssue?.code !== "missing_credentials" &&
+      desktopAuthIssue?.error !== "missing_credentials"
+    ) {
+      return;
+    }
+    setShowWizard(true);
+    fetchStatus();
+  }, [desktopAuthIssue, fetchStatus]);
+
   const allConfigured =
     envStatus.length > 0 && envStatus.every((k) => k.configured);
 

package/corpus/templates/calendar/app/components/layout/Sidebar.tsx

@@ -44,6 +44,7 @@ import {
 } from "date-fns";
 import { useState, useEffect, useMemo } from "react";
 import { Link, useLocation, useNavigate } from "react-router";
+import { toast } from "sonner";
 
 import { ThemeToggle } from "@/components/ThemeToggle";
 import { Button } from "@/components/ui/button";
@@ -322,6 +323,8 @@ function GoogleConnectSidebarButton() {
     isGoogleDesktopAuthPending,
     startDesktopGoogleAuth,
   } = useGoogleDesktopAuth({
+    onError: (issue) =>
+      toast.error(issue.message || issue.error || t("settings.googleFailed")),
     onSuccess: () => window.location.reload(),
   });
 
@@ -331,6 +334,12 @@ function GoogleConnectSidebarButton() {
     window.open(authUrl.data.url, "_blank");
   }, [wantAuthUrl, authUrl.data]);
 
+  useEffect(() => {
+    if (!authUrl.error) return;
+    toast.error(authUrl.error.message);
+    setWantAuthUrl(false);
+  }, [authUrl.error]);
+
   function handleConnect() {
     if (isDesktopGoogleAuth) {
       startDesktopGoogleAuth({ previousAccountCount: 0 });
@@ -435,6 +444,8 @@ function GoogleAccountsSection({
     isGoogleDesktopAuthPending,
     startDesktopGoogleAuth,
   } = useGoogleDesktopAuth({
+    onError: (issue) =>
+      toast.error(issue.message || issue.error || t("settings.googleFailed")),
     onSuccess: () => window.location.reload(),
   });
 
@@ -444,6 +455,12 @@ function GoogleAccountsSection({
     setWantAddAccount(false);
   }, [wantAddAccount, addAccountUrl.data]);
 
+  useEffect(() => {
+    if (!addAccountUrl.error) return;
+    toast.error(addAccountUrl.error.message);
+    setWantAddAccount(false);
+  }, [addAccountUrl.error]);
+
   function handleAddAccount() {
     if (isDesktopGoogleAuth) {
       startDesktopGoogleAuth({

package/corpus/templates/calendar/app/hooks/use-google-auth.ts

@@ -45,6 +45,23 @@ function bodyError(
     `${fallback} (HTTP ${res.status})`;
   const error = new Error(message);
   (error as any).status = res.status;
+  if (body && typeof body === "object") {
+    const record = body as Record<string, unknown>;
+    for (const key of [
+      "error",
+      "code",
+      "accountId",
+      "existingOwner",
+      "attemptedOwner",
+    ]) {
+      if (typeof record[key] === "string") {
+        (error as any)[key] = record[key];
+      }
+    }
+    if (!(error as any).code && typeof record.error === "string") {
+      (error as any).code = record.error;
+    }
+  }
   return error;
 }
 
@@ -204,6 +221,33 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
         setIsPending(false);
         onError?.(issue);
       };
+      const authStartIssue = (err: unknown): DesktopAuthIssue => {
+        const source = err as Partial<DesktopAuthIssue> | undefined;
+        const message =
+          err instanceof Error
+            ? err.message
+            : "Could not start Google sign-in.";
+        return {
+          code:
+            typeof source?.code === "string"
+              ? source.code
+              : "desktop_auth_start_failed",
+          error: typeof source?.error === "string" ? source.error : undefined,
+          message,
+          accountId:
+            typeof source?.accountId === "string"
+              ? source.accountId
+              : undefined,
+          existingOwner:
+            typeof source?.existingOwner === "string"
+              ? source.existingOwner
+              : undefined,
+          attemptedOwner:
+            typeof source?.attemptedOwner === "string"
+              ? source.attemptedOwner
+              : undefined,
+        };
+      };
       const openAuthUrl = (url: string) => {
         if (popup && !popup.closed) {
           popup.location.href = url;
@@ -220,50 +264,37 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
         await onSuccess?.(result);
       };
 
-      if (startOptions.addAccount) {
-        popup = window.open("about:blank", "_blank");
-        void (async () => {
-          try {
-            const { url } = await fetchJson<{ url: string }>(
-              agentNativePath(
-                `/_agent-native/google/add-account/auth-url?${params.toString()}`,
-              ),
-              { credentials: "include" },
-            );
-            if (!openAuthUrl(url)) {
-              reportError({
-                code: "popup_blocked",
-                message:
-                  "Calendar could not open Google sign-in. Allow popups and try again.",
-              });
-            }
-          } catch (err) {
-            popup?.close();
+      popup = window.open("about:blank", "_blank");
+      if (!popup) {
+        reportError({
+          code: "popup_blocked",
+          message:
+            "Calendar could not open Google sign-in. Allow popups and try again.",
+        });
+        return true;
+      }
+
+      void (async () => {
+        try {
+          const path = startOptions.addAccount
+            ? "/_agent-native/google/add-account/auth-url"
+            : "/_agent-native/google/auth-url";
+          const { url } = await fetchJson<{ url: string }>(
+            agentNativePath(`${path}?${params.toString()}`),
+            { credentials: "include" },
+          );
+          if (!openAuthUrl(url)) {
             reportError({
-              code: "desktop_auth_start_failed",
+              code: "popup_blocked",
               message:
-                err instanceof Error
-                  ? err.message
-                  : "Could not start Google sign-in.",
+                "Calendar could not open Google sign-in. Allow popups and try again.",
             });
           }
-        })();
-      } else {
-        params.set("redirect", "1");
-        const opened = openAuthUrl(
-          `${window.location.origin}${agentNativePath(
-            "/_agent-native/google/auth-url",
-          )}?${params.toString()}`,
-        );
-        if (!opened) {
-          reportError({
-            code: "popup_blocked",
-            message:
-              "Calendar could not open Google sign-in. Allow popups and try again.",
-          });
-          return true;
+        } catch (err) {
+          popup?.close();
+          reportError(authStartIssue(err));
         }
-      }
+      })();
 
       pollRef.current = setInterval(async () => {
         try {

package/corpus/templates/calendar/changelog/2026-06-30-google-calendar-connection-errors-now-stay-in-the-app-instea.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-06-30
+---
+
+Google Calendar connection errors now stay in the app instead of opening a blank sign-in window.

package/corpus/templates/calendar/server/handlers/google-auth.ts

@@ -43,6 +43,28 @@ const GOOGLE_IDENTITY_SCOPES = [
   "https://www.googleapis.com/auth/userinfo.profile",
 ];
 
+type CalendarOAuthStateOptions = {
+  redirectUri: string;
+  owner?: string;
+  orgId?: string;
+  desktop?: boolean;
+  addAccount?: boolean;
+  app?: string;
+  returnUrl?: string;
+  flowId?: string;
+};
+
+function encodeCalendarOAuthState(options: CalendarOAuthStateOptions): string {
+  return encodeOAuthState(options as any);
+}
+
+function getCalendarOAuthStateOrgId(
+  state: ReturnType<typeof decodeOAuthState>,
+): string | undefined {
+  return (state as ReturnType<typeof decodeOAuthState> & { orgId?: string })
+    .orgId;
+}
+
 async function resolveCalendarOAuthCredentials(event: H3Event) {
   const session = await getSession(event).catch(() => null);
   const { clientId, clientSecret } = await runWithRequestContext(
@@ -182,6 +204,28 @@ function googleOAuthErrorResponse(
   return oauthErrorPage(payload.message);
 }
 
+function missingCredentialsResponse(
+  event: H3Event,
+  message: string,
+  opts: { desktop?: boolean; flowId?: string; redirect?: boolean } = {},
+) {
+  if (opts.desktop && opts.flowId) {
+    setDesktopExchangeError(opts.flowId, {
+      message,
+      code: "missing_credentials",
+    });
+    return oauthDesktopExchangePage("Returning to Calendar...");
+  }
+  if (opts.redirect) {
+    return oauthErrorPage(message);
+  }
+  setResponseStatus(event, 422);
+  return {
+    error: "missing_credentials",
+    message,
+  };
+}
+
 export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
   try {
     const q = getQuery(event);
@@ -195,6 +239,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     }
     const session = await getSession(event);
     const owner = session?.email;
+    const orgId = session?.orgId;
     const desktop =
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
@@ -204,13 +249,13 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       : resolveGoogleSignInCredentials();
 
     if (!credentials) {
-      setResponseStatus(event, 422);
-      return {
-        error: "missing_credentials",
-        message: calendarConnect
+      return missingCredentialsResponse(
+        event,
+        calendarConnect
           ? "Google Calendar OAuth credentials are not configured. Save GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in settings."
           : "Google sign-in credentials are not configured. Set GOOGLE_SIGN_IN_CLIENT_ID and GOOGLE_SIGN_IN_CLIENT_SECRET.",
-      };
+        { desktop, flowId, redirect: q.redirect === "1" },
+      );
     }
 
     if (calendarConnect && !owner) {
@@ -226,9 +271,10 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
     // Use the named-arg overload — the positional form previously passed
     // `flowId` in the `returnUrl` slot, breaking desktop completion.
-    const state = encodeOAuthState({
+    const state = encodeCalendarOAuthState({
       redirectUri,
       owner,
+      orgId,
       desktop,
       addAccount: calendarConnect,
       app: OAUTH_STATE_APP_ID,
@@ -237,7 +283,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     });
 
     const url = calendarConnect
-      ? await getAuthUrl(undefined, redirectUri, state, owner)
+      ? await getAuthUrl(undefined, redirectUri, state, owner, orgId)
       : `${GOOGLE_AUTH_URL}?${new URLSearchParams({
           client_id: credentials.clientId,
           redirect_uri: redirectUri,
@@ -293,6 +339,7 @@ export const handleGoogleCallback = defineEventHandler(
       }
 
       const { redirectUri, owner: stateOwner, addAccount, returnUrl } = state;
+      const stateOrgId = getCalendarOAuthStateOrgId(state);
 
       // 1. Resolve owner (needs session context, before exchangeCode)
       const { owner, hasProductionSession } = await resolveOAuthOwner(
@@ -330,7 +377,13 @@ export const handleGoogleCallback = defineEventHandler(
       }
 
       // 2. Exchange code with Google (template-specific Calendar connect)
-      const email = await exchangeCode(code, undefined, redirectUri, owner);
+      const email = await exchangeCode(
+        code,
+        undefined,
+        redirectUri,
+        owner,
+        stateOrgId,
+      );
 
       // 3. Create session token (after we have the email)
       // Skip for add-account flows — adding a second account must not switch
@@ -372,16 +425,18 @@ export const getGoogleAddAccountUrl = defineEventHandler(
       setResponseStatus(event, 401);
       return { error: "Must be logged in to add an account" };
     }
+    const q = getQuery(event);
+    const desktop =
+      isElectron(event) || q.desktop === "1" || q.desktop === "true";
+    const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
     if (!(await resolveCalendarOAuthCredentials(event))) {
-      setResponseStatus(event, 422);
-      return {
-        error: "missing_credentials",
-        message:
-          "Google OAuth credentials are not configured. Save GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in settings.",
-      };
+      return missingCredentialsResponse(
+        event,
+        "Google OAuth credentials are not configured. Save GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in settings.",
+        { desktop, flowId, redirect: q.redirect === "1" },
+      );
     }
     try {
-      const q = getQuery(event);
       const redirectUri = resolveOAuthRedirectUri(event);
       if (!redirectUri) {
         setResponseStatus(event, 400);
@@ -390,12 +445,10 @@ export const getGoogleAddAccountUrl = defineEventHandler(
           message: "redirect_uri must stay on this app's _agent-native routes.",
         };
       }
-      const desktop =
-        isElectron(event) || q.desktop === "1" || q.desktop === "true";
-      const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
-      const state = encodeOAuthState({
+      const state = encodeCalendarOAuthState({
         redirectUri,
         owner: session.email,
+        orgId: session.orgId,
         desktop,
         addAccount: true,
         app: OAUTH_STATE_APP_ID,
@@ -406,6 +459,7 @@ export const getGoogleAddAccountUrl = defineEventHandler(
         redirectUri,
         state,
         session.email,
+        session.orgId,
       );
       if (q.redirect === "1") {
         return oauthRedirectResponse(url);
@@ -449,6 +503,7 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
       }
 
       const { redirectUri, owner: stateOwner } = state;
+      const stateOrgId = getCalendarOAuthStateOrgId(state);
 
       const ownerEmail = session?.email || stateOwner;
       if (!ownerEmail) {
@@ -466,6 +521,7 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
         undefined,
         redirectUri,
         ownerEmail,
+        session?.orgId ?? stateOrgId,
       );
 
       return oauthCallbackResponse(event, addedEmail, {
@@ -486,7 +542,7 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
 export const getGoogleStatus = defineEventHandler(async (event: H3Event) => {
   try {
     const session = await getSession(event);
-    return await getAuthStatus(session?.email);
+    return await getAuthStatus(session?.email, session?.orgId);
   } catch (error: any) {
     setResponseStatus(event, 500);
     return { error: error.message };
@@ -506,7 +562,7 @@ export const disconnectGoogle = defineEventHandler(async (event: H3Event) => {
       setResponseStatus(event, 400);
       return { error: "email is required" };
     }
-    const owned = await getAuthStatus(session.email);
+    const owned = await getAuthStatus(session.email, session.orgId);
     const isOwned = owned.accounts.some((a) => a.email === targetEmail);
     if (!isOwned) {
       setResponseStatus(event, 403);

package/corpus/templates/calendar/server/lib/google-calendar.ts

@@ -7,6 +7,7 @@ import {
 import {
   isOAuthConnected,
   getOAuthAccounts,
+  getRequestOrgId,
   resolveSecret,
   runWithRequestContext,
 } from "@agent-native/core/server";
@@ -61,9 +62,9 @@ function optionalString(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
-async function getOAuth2Credentials(owner?: string) {
+async function getOAuth2Credentials(owner?: string, orgId?: string) {
   const credentials = (
-    await resolveGoogleProviderCredentialCandidates(owner)
+    await resolveGoogleProviderCredentialCandidates(owner, orgId)
   )[0];
   if (!credentials) {
     throw new Error(
@@ -73,8 +74,11 @@ async function getOAuth2Credentials(owner?: string) {
   return credentials;
 }
 
-async function getOAuth2RefreshCredentials(owner?: string) {
-  const candidates = await resolveGoogleProviderCredentialCandidates(owner);
+async function getOAuth2RefreshCredentials(owner?: string, orgId?: string) {
+  const candidates = await resolveGoogleProviderCredentialCandidates(
+    owner,
+    orgId,
+  );
   if (!candidates.length) {
     throw new Error(
       "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be saved in settings",
@@ -97,6 +101,7 @@ async function readCredentialPair(
 
 async function resolveGoogleProviderCredentialCandidates(
   owner?: string,
+  orgId?: string,
 ): Promise<GoogleOAuthCredentials[]> {
   const resolve = async () => {
     const primary = await readCredentialPair(
@@ -111,8 +116,9 @@ async function resolveGoogleProviderCredentialCandidates(
     if (!legacy || legacy.clientId === primary.clientId) return [primary];
     return [primary, legacy];
   };
+  const resolvedOrgId = orgId ?? getRequestOrgId();
   return owner
-    ? runWithRequestContext({ userEmail: owner }, resolve)
+    ? runWithRequestContext({ userEmail: owner, orgId: resolvedOrgId }, resolve)
     : await resolve();
 }
 
@@ -359,6 +365,7 @@ async function getValidAccessToken(
   accountId: string,
   tokens: GoogleTokens,
   owner?: string,
+  orgId?: string,
 ): Promise<string> {
   // Check if token is expired (with 5-minute buffer)
   if (tokens.expiry_date && tokens.expiry_date < Date.now() + 5 * 60 * 1000) {
@@ -375,7 +382,7 @@ async function getValidAccessToken(
       for (const {
         clientId,
         clientSecret,
-      } of await getOAuth2RefreshCredentials(owner)) {
+      } of await getOAuth2RefreshCredentials(owner, orgId)) {
         try {
           const oauth2 = createOAuth2Client(clientId, clientSecret, "");
           const newTokens = await oauth2.refreshToken(tokens.refresh_token);
@@ -420,8 +427,9 @@ export async function getAuthUrl(
   redirectUri?: string,
   state?: string,
   owner?: string,
+  orgId?: string,
 ): Promise<string> {
-  const { clientId, clientSecret } = await getOAuth2Credentials(owner);
+  const { clientId, clientSecret } = await getOAuth2Credentials(owner, orgId);
   const uri =
     redirectUri ||
     (origin ? `${origin}/_agent-native/google/callback` : undefined);
@@ -439,8 +447,9 @@ export async function exchangeCode(
   origin?: string,
   redirectUri?: string,
   owner?: string,
+  orgId?: string,
 ): Promise<string> {
-  const { clientId, clientSecret } = await getOAuth2Credentials(owner);
+  const { clientId, clientSecret } = await getOAuth2Credentials(owner, orgId);
   const uri =
     redirectUri ||
     (origin ? `${origin}/_agent-native/google/callback` : undefined);
@@ -621,6 +630,7 @@ export async function getPrimaryAccountPhotoUrl(
 
 export async function getAuthStatus(
   forEmail?: string,
+  orgId?: string,
 ): Promise<GoogleAuthStatus> {
   const oauthAccounts = await getOAuthAccounts("google", forEmail);
 
@@ -642,6 +652,7 @@ export async function getAuthStatus(
         account.accountId,
         tokens,
         forEmail,
+        orgId,
       );
       tokenValid = true;
       photoUrl = await resolveAccountPhotoUrl(accessToken, photoUrl);