@danceiny/gotry 0.2.0-rc.32 → 0.2.0-rc.33

package/dist/src/backend/modules/booking-executor.js

@@ -11,9 +11,19 @@
  *
  * 观察器可注入(测试/未来多供应商扩展);缺省实现 = CDP 只读观察
  * (openSession,ReadGuard 照常生效)。
+ *
+ * AaaS(docs/rfc/aaas-rfc.md §4.8,威胁 S-19)——缺省观察器读的是宿主机上**同一个** Chrome 和它里面**同一份**供应商登录,
+ * 所以它天生是单组织的:只有持有该登录的组织(hostBrowserOrganization,缺省 local)的调用方能用它。
+ *   - callerOrganization(req):宿主在 bearer 之后解出调用方组织(null/非法/抛错 → 403 organization-unresolved);
+ *     组织从不取自请求体或请求头;缺省 = 单组织形态,所有调用方都是 local;
+ *   - 缺省(宿主 Chrome)观察器遇到别的组织 → 403,不碰浏览器;声明了 callerOrganization 却没说宿主浏览器属于谁 →
+ *     构造即失败(多组织部署必须点名);
+ *   - 注入的 observe 是组织感知的:收到解出的组织,自己负责把浏览器绑到该组织(云端多租户浏览器需要新 ADR,
+ *     见 RFC §4.8 的入场条件——供应商登录只在员工浏览器里,云端无法替租户持有)。
  */
 import { mkdirSync } from 'node:fs';
 import { openSession } from '../../../capabilities/session/transport.js';
+import { BRIDGE_DEFAULT_ORGANIZATION, isBridgeOrganization } from '../../../capabilities/session/extension-bridge.js';
 function sendJson(res, status, body) {
     res.statusCode = status;
     res.setHeader('content-type', 'application/json');
@@ -66,6 +76,15 @@ export async function defaultObserve(req, evidenceDir) {
     }
 }
 export function startBookingExecutorModule(options) {
+    if (options.hostBrowserOrganization !== undefined && !isBridgeOrganization(options.hostBrowserOrganization)) {
+        throw new Error('booking_executor_host_browser_organization_invalid');
+    }
+    // A deployment that tells us it serves several organizations must also say whose login the host browser holds: with the
+    // default observer and no answer, every organization would ride one organization's supplier login.
+    if (options.callerOrganization && !options.observe && options.hostBrowserOrganization === undefined) {
+        throw new Error('booking_executor_host_browser_organization_required');
+    }
+    const hostBrowserOrganization = options.hostBrowserOrganization ?? BRIDGE_DEFAULT_ORGANIZATION;
     const authorized = (req, res) => {
         const key = options.apiKey();
         const auth = String(req.headers.authorization ?? '');
@@ -79,16 +98,39 @@ export function startBookingExecutorModule(options) {
         }
         return true;
     };
-    const observe = options.observe ?? (async (req) => defaultObserve(req, '/tmp/booking-evidence'));
-    async function handleObserve(req, res) {
-        let parsed;
+    const hostBrowserObserve = options.hostBrowserObserve ?? (async (req) => defaultObserve(req, '/tmp/booking-evidence'));
+    /** 解出本次请求的组织:无注入点 = local;解不出/非法 → 403 并返回 null(请求不碰任何观察器) */
+    const resolveOrganization = (req, res) => {
+        if (!options.callerOrganization)
+            return BRIDGE_DEFAULT_ORGANIZATION;
+        let resolved;
+        try {
+            resolved = options.callerOrganization(req);
+        }
+        catch {
+            resolved = null;
+        }
+        if (resolved === null || !isBridgeOrganization(resolved)) {
+            sendJson(res, 403, { ok: false, error: 'organization-unresolved' });
+            return null;
+        }
+        return resolved;
+    };
+    async function handleObserve(req, res, organization) {
+        let decoded;
         try {
-            parsed = JSON.parse(await readBody(req));
+            decoded = JSON.parse(await readBody(req));
         }
         catch {
             sendJson(res, 400, { ok: false, error: 'body 不是 JSON' });
             return;
         }
+        // `null`, a number, a string or an array is JSON too; reading a field from one would throw outside any handler.
+        if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {
+            sendJson(res, 400, { ok: false, error: 'body 不是 JSON 对象' });
+            return;
+        }
+        const parsed = decoded;
         const supplier = (parsed.supplier ?? '').trim();
         if (supplier !== 'dida-portal') {
             sendJson(res, 400, { ok: false, error: `未知供应商通道 ${supplier || '(空)'}` });
@@ -99,8 +141,18 @@ export function startBookingExecutorModule(options) {
             sendJson(res, 400, { ok: false, error: 'entry URL 必须落在 https://portal.dida.com/ 域内' });
             return;
         }
+        // The request handed to an observer is built from the validated fields and the host-resolved organization only:
+        // whatever organization the body names (`parsed.organization`) is never read.
+        // In the single-organization form the request has the shape it always had; the organization is added only where a host
+        // resolves one.
+        const observation = options.callerOrganization ? { supplier, entryUrl, organization } : { supplier, entryUrl };
+        if (!options.observe && organization !== hostBrowserOrganization) {
+            // The host browser holds one organization's supplier login; another organization's caller must not ride it.
+            sendJson(res, 403, { ok: false, error: 'executor-organization-mismatch' });
+            return;
+        }
         try {
-            const result = await observe({ supplier, entryUrl });
+            const result = await (options.observe ?? hostBrowserObserve)(observation);
             sendJson(res, 200, result);
         }
         catch (e) {
@@ -116,7 +168,10 @@ export function startBookingExecutorModule(options) {
                 handle: (req, res) => {
                     if (!authorized(req, res))
                         return;
-                    void handleObserve(req, res);
+                    const organization = resolveOrganization(req, res);
+                    if (organization === null)
+                        return;
+                    void handleObserve(req, res, organization);
                 },
             },
         ],

package/dist/src/backend/modules/session-search.js

@@ -21,6 +21,13 @@
  *   POST /v1/session/bridge/events  → 扩展 workspace 事件批量上行(批次 B,2026-10-01;
  *                                     body ≤256KB,逐条落 bridge_events,响应 {accepted,rejected})
  *
+ * AaaS A2(#674,S-5)组织维度(两个可选注入点,缺省 = 今天的单车道 `local`,行为逐字不变):
+ *   - callerOrganization(req):宿主在 bearer 之后解出本次请求的组织(null/非法 → 403
+ *     organization-unresolved);桥端点、事件落账、节律读判定、检索/登录提交都按它走,
+ *     提交经 queue.forOrganization(org),下游代码没有办法把作业提交去别的组织;
+ *   - admission(req, organization):配额闸(每组织/每租户的桥作业速率由部署组合接入,A3),
+ *     拒绝 → 429 + retry-after,release 在 finally 里执行。
+ *
  * 红线继承:登录在供应商官网由人完成;challenged 即停;节律闸在 sessionDidaSearch
  * 内;本模块再加单飞锁(同供应商串行,防并发打站点)。桥端点在 bearer 之上再强制
  * Origin ∈ 扩展白名单(网页跨域请求必带邪恶 Origin,双保险)。
@@ -31,9 +38,9 @@
  * latencyMs/error 摘要,脱敏)。与桥账本(bridge_jobs,PR #601)互补——日志管
  * 「看」,账本管「恢复」,verdict 不写 bridge_jobs。
  */
-import { sessionDidaSearch } from '../../../capabilities/session-search.js';
+import { resolveTransportMode, sessionDidaSearch } from '../../../capabilities/session-search.js';
 import { DIDA_LOGIN_COOKIE_NAMES, DIDA_SITE_DOMAIN } from '../../../capabilities/session/adapters/dida-portal.js';
-import { CLIENT_ID_RE, createBridgeJobQueue, EXTENSION_ORIGINS } from '../../../capabilities/session/extension-bridge.js';
+import { BRIDGE_DEFAULT_ORGANIZATION, CLIENT_ID_RE, createBridgeJobQueue, EXTENSION_ORIGINS, isBridgeOrganization } from '../../../capabilities/session/extension-bridge.js';
 import { openBridgeLedgerStore } from '../../../capabilities/session/bridge-ledger.js';
 import { extensionCookieNames, extensionOpenLogin, classifyBridgeFailure } from '../../../capabilities/session/extension-channel.js';
 /** 事件上行端点路径(批次 B;导出供 extension-tests §38 与扩展侧 background.js 防漂移对账) */
@@ -258,7 +265,26 @@ async function withLock(key, fn) {
             locks.delete(key);
     }
 }
+/**
+ * 桥面扩展 Origin 白名单的运维覆盖:unpacked 安装的扩展 ID 随装载绝对路径变化
+ * (SHA256(path) 前 32 位映射 a-p),把员工本机的安装挡在 403(hotel-be#32143 验收
+ * 实测;hotel-be#34173 UAT 复验发现 10-01 cherry-pick 未进 main,10-17 例行发版回退)。
+ * 默认仍收 unpacked dev + 商店双通道;env 以逗号追加合法 origin。
+ */
+function bridgeExtensionOrigins() {
+    const raw = process.env.GOTRY_SESSION_BRIDGE_EXTENSION_ORIGINS;
+    if (!raw)
+        return undefined;
+    const extra = [...new Set(raw.split(',')
+            .map((s) => s.trim())
+            .filter((s) => /^chrome-extension:\/\/[a-p]{32}$/.test(s)))];
+    return extra.length ? [...EXTENSION_ORIGINS, ...extra] : undefined;
+}
 export function startSessionSearchModule(options) {
+    // AaaS A2: the cdp transport drives the host's own Chrome whoever asks, so a second organization could ride it. The
+    // organization-scoped form therefore runs on the extension bridge only (the single lane keeps the cdp opt-in).
+    if (options.callerOrganization && resolveTransportMode() !== 'extension')
+        throw new Error('session_search_organization_requires_extension_transport');
     const search = options.search ?? sessionDidaSearch;
     // verdict 结构化日志通道(#272):缺省 stderr(服务运行时既见面),测试注入收集器
     const verdictEmit = options.verdictLog ?? ((line) => { process.stderr.write(`${line}\n`); });
@@ -283,10 +309,10 @@ export function startSessionSearchModule(options) {
             // 账本开不了不打断服务:退回纯内存(重启丢在飞的旧缺陷面),stderr 留痕
             process.stderr.write(`[session-search] 桥账本打开失败,退回纯内存队列: ${e instanceof Error ? e.message : String(e)}\n`);
         }
-        queue = createBridgeJobQueue(ledger ? { store: ledger } : {});
+        queue = createBridgeJobQueue(ledger ? { store: ledger, extensionOrigins: bridgeExtensionOrigins() } : { extensionOrigins: bridgeExtensionOrigins() });
     }
     else {
-        queue = createBridgeJobQueue();
+        queue = createBridgeJobQueue({ extensionOrigins: bridgeExtensionOrigins() });
     }
     // 开机恢复(gotry-backend 会话模块启动路径):queued→重排;claimed 已超时→
     // unresolved+节律记账;claimed 未超时→复活 inFlight(重启不再丢在飞作业)。
@@ -307,6 +333,66 @@ export function startSessionSearchModule(options) {
         }
         return true;
     };
+    /** 解出本次请求的组织:无注入点 = 单车道 local;解不出/非法 → 403 并返回 null(请求不进桥) */
+    const resolveOrganization = (req, res) => {
+        if (!options.callerOrganization)
+            return BRIDGE_DEFAULT_ORGANIZATION;
+        let resolved;
+        try {
+            resolved = options.callerOrganization(req);
+        }
+        catch {
+            resolved = null;
+        }
+        if (resolved === null || !isBridgeOrganization(resolved)) {
+            sendJson(res, 403, { ok: false, error: 'organization-unresolved' });
+            return null;
+        }
+        return resolved;
+    };
+    /** bearer → 组织 → 业务:每个路由先后过这两道,组织只解一次 */
+    const withOrganization = (req, res, run) => {
+        if (!authorized(req, res))
+            return;
+        const organization = resolveOrganization(req, res);
+        if (organization === null)
+            return;
+        run(organization);
+    };
+    // 单车道(无注入点)下沿用今天的调用形状:队列本体 + 无参 stats/extensionConnected(既有假队列也只实现这些)
+    const scoped = options.callerOrganization !== undefined;
+    const bridgeFor = (organization) => (scoped ? queue.forOrganization(organization) : queue);
+    const connectedOf = (organization) => (scoped ? queue.extensionConnected(organization) : queue.extensionConnected());
+    const statsOf = (organization) => (scoped ? queue.stats(organization) : queue.stats());
+    const bridgeCaller = (organization) => (scoped ? { organization } : undefined);
+    /** 配额闸:放行返回 release 钩子(可无);拒绝已写好 429/503 响应,返回 null */
+    const admit = (req, res, organization) => {
+        if (!options.admission)
+            return {};
+        let decision;
+        try {
+            decision = options.admission(req, organization);
+            // a return that is not a decision is an admission that could not be made: the same answer as a throw, never a crash
+            if (typeof decision !== 'object' || decision === null || typeof decision.ok !== 'boolean')
+                throw new Error('admission_decision_malformed');
+        }
+        catch {
+            sendJson(res, 503, { ok: false, error: 'admission-unavailable' });
+            return null;
+        }
+        if (decision.ok)
+            return typeof decision.release === 'function' ? { release: decision.release } : {};
+        const retryAfter = Number.isFinite(decision.retryAfterSeconds) ? Math.max(1, Math.ceil(decision.retryAfterSeconds)) : 1;
+        res.setHeader('retry-after', String(retryAfter));
+        sendJson(res, 429, { ok: false, verdict: 'quota_exceeded', error: typeof decision.code === 'string' && decision.code.length > 0 ? decision.code : 'quota_exceeded' });
+        return null;
+    };
+    const releaseAdmission = (admitted) => {
+        try {
+            admitted.release?.();
+        }
+        catch { /* 释放额度的失败不反噬已写出的响应 */ }
+    };
     /**
      * 扩展 workspace 事件批量上行(批次 B,2026-10-01):bearer(路由前置 authorized)之上
      * 再强制 Origin ∈ 扩展白名单——与 /jobs 同链(同一 EXTENSION_ORIGINS 常量,网页跨域
@@ -318,7 +404,7 @@ export function startSessionSearchModule(options) {
      * fail-closed 503:事件无处落账,不假成功。
      */
     const extensionOrigins = new Set(EXTENSION_ORIGINS);
-    async function handleBridgeEvents(req, res) {
+    async function handleBridgeEvents(req, res, organization) {
         const origin = req.headers.origin;
         if (typeof origin !== 'string' || !extensionOrigins.has(origin)) {
             sendJson(res, 403, { ok: false, error: 'origin 不在桥白名单' });
@@ -366,7 +452,7 @@ export function startSessionSearchModule(options) {
                 continue;
             }
             try {
-                if (ledger.insertEvent(input))
+                if (ledger.insertEvent(organization, input))
                     accepted += 1;
                 else
                     rejected += 1;
@@ -378,36 +464,36 @@ export function startSessionSearchModule(options) {
         }
         sendJson(res, 200, { ok: true, accepted, rejected });
     }
-    async function handleStatus(res) {
+    async function handleStatus(res, organization) {
         const startedAt = Date.now();
         const checkedAt = new Date().toISOString();
-        if (!queue.extensionConnected()) {
+        if (!connectedOf(organization)) {
             sendJson(res, 200, {
                 ok: true,
                 suppliers: [{ supplier: 'dida-portal', loggedIn: false, reason: 'extension-not-connected', detail: '会话执行环境=管理员浏览器扩展(Stai Travel Bridge);扩展未连接桥——在管理员浏览器安装扩展并配置本服务桥地址' }],
-                bridge: queue.stats(),
+                bridge: statsOf(organization),
                 checkedAt,
             });
             verdictLog({ surface: 'status', supplier: 'dida-portal', verdict: 'needs-extension', latencyMs: Date.now() - startedAt });
             return;
         }
-        const login = await extensionCookieNames({ site: 'dida-portal', domain: DIDA_SITE_DOMAIN, ticketNames: DIDA_LOGIN_COOKIE_NAMES, timeoutMs: 20_000 }, queue);
+        const login = await extensionCookieNames({ site: 'dida-portal', domain: DIDA_SITE_DOMAIN, ticketNames: DIDA_LOGIN_COOKIE_NAMES, timeoutMs: 20_000 }, bridgeFor(organization));
         if (!login.ok) {
             const verdict = classifyBridgeFailure(login.kind);
-            sendJson(res, 200, { ok: true, suppliers: [{ supplier: 'dida-portal', loggedIn: false, reason: verdict, detail: login.summary }], bridge: queue.stats(), checkedAt });
+            sendJson(res, 200, { ok: true, suppliers: [{ supplier: 'dida-portal', loggedIn: false, reason: verdict, detail: login.summary }], bridge: statsOf(organization), checkedAt });
             verdictLog({ surface: 'status', supplier: 'dida-portal', verdict, latencyMs: Date.now() - startedAt, error: login.summary });
             return;
         }
         sendJson(res, 200, {
             ok: true,
             suppliers: [{ supplier: 'dida-portal', loggedIn: login.tickets.length > 0, tickets: login.tickets, ...(login.tickets.length === 0 ? { reason: 'needs-login' } : {}) }],
-            bridge: queue.stats(),
+            bridge: statsOf(organization),
             checkedAt,
         });
         // tickets 只有 cookie 名级(值零过手),verdict 行也只落登录态结论本身
         verdictLog({ surface: 'status', supplier: 'dida-portal', verdict: login.tickets.length > 0 ? 'logged-in' : 'needs-login', latencyMs: Date.now() - startedAt });
     }
-    async function handleSearch(req, res) {
+    async function handleSearch(req, res, organization) {
         const startedAt = Date.now();
         const parsed = await readAndParseObjectBody(req);
         if ('code' in parsed) {
@@ -431,7 +517,7 @@ export function startSessionSearchModule(options) {
         }
         // 挂载路径节律读判定(批次 A):账本口径跨重启(超时结算/上一次提交都在库里),
         // 与 sessionDidaSearch 的进程内节律闸双闸取严——内存闸挡本进程,账本闸挡重启前打过的站点。
-        const pacing = ledger?.pacingOf(supplier);
+        const pacing = ledger?.pacingOf(organization, supplier);
         if (pacing && Date.now() < pacing.cooldownUntil) {
             const retryAfterSec = Math.max(1, Math.ceil((pacing.cooldownUntil - Date.now()) / 1_000));
             res.setHeader('retry-after', String(retryAfterSec));
@@ -443,9 +529,15 @@ export function startSessionSearchModule(options) {
             verdictLog({ surface: 'search', supplier, verdict: 'cooldown', latencyMs: Date.now() - startedAt, error: `bridge ledger cooldown retry-after ${retryAfterSec}s` });
             return;
         }
+        // 配额闸:只有真要动桥的请求才占额度——上面的形状校验与账本冷却已拦下的不算
+        const admitted = admit(req, res, organization);
+        if (admitted === null)
+            return;
         try {
             const q = queryCheck.query;
-            const result = await withLock(supplier, () => search({
+            // 单飞锁按 组织+站点:一个组织的慢检索不排队另一个组织(单车道 local 的锁键仍是 supplier 本身)
+            const lockKey = organization === BRIDGE_DEFAULT_ORGANIZATION ? supplier : `${organization}/${supplier}`;
+            const result = await withLock(lockKey, () => search({
                 entryUrl: q?.entryUrl,
                 timeoutMs: q?.timeoutMs,
                 // 查询态(城市+日期)交给能力层 → 扩展驱动门户目的地搜索
@@ -453,7 +545,9 @@ export function startSessionSearchModule(options) {
                     ? { query: { city: q.city, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults, children: q.children } }
                     : {}),
                 auditPath: options.auditPath,
-                bridge: queue,
+                bridge: bridgeFor(organization),
+                // the in-process pacing gate is keyed like the lock: one organization's searches never pace another's
+                pacingKey: lockKey,
             }));
             if (result.verdict === 'cooldown') {
                 res.setHeader('retry-after', '30');
@@ -489,8 +583,11 @@ export function startSessionSearchModule(options) {
             sendJson(res, 500, { ok: false, error: `会话检索异常: ${e instanceof Error ? e.message.slice(0, 200) : String(e)}` });
             verdictLog({ surface: 'search', supplier, verdict: 'error', latencyMs: Date.now() - startedAt, error: e instanceof Error ? e.message : String(e) });
         }
+        finally {
+            releaseAdmission(admitted);
+        }
     }
-    async function handleLoginOpen(req, res) {
+    async function handleLoginOpen(req, res, organization) {
         const parsed = await readAndParseObjectBody(req);
         if ('code' in parsed) {
             sendJson(res, 400, { ok: false, error: validationMessage(parsed.code) });
@@ -516,35 +613,35 @@ export function startSessionSearchModule(options) {
             sendJson(res, 400, { ok: false, error: '登录入口必须落在 https://portal.dida.com/ 域内(fail-closed)' });
             return;
         }
-        const outcome = await extensionOpenLogin({ site: supplier, url, timeoutMs: 20_000 }, queue);
-        if (!outcome.ok) {
-            const verdict = classifyBridgeFailure(outcome.kind);
-            sendJson(res, verdict === 'needs-extension' ? 503 : 502, { ok: false, verdict, error: outcome.summary });
+        const admitted = admit(req, res, organization);
+        if (admitted === null)
             return;
+        try {
+            const outcome = await extensionOpenLogin({ site: supplier, url, timeoutMs: 20_000 }, bridgeFor(organization));
+            if (!outcome.ok) {
+                const verdict = classifyBridgeFailure(outcome.kind);
+                sendJson(res, verdict === 'needs-extension' ? 503 : 502, { ok: false, verdict, error: outcome.summary });
+                return;
+            }
+            sendJson(res, 200, { ok: true, opened: true, url, note: '登录页已在会话所属浏览器置前台打开(验证码人过);gotry 永不经手密码/cookie 值' });
+        }
+        finally {
+            releaseAdmission(admitted);
         }
-        sendJson(res, 200, { ok: true, opened: true, url, note: '登录页已在会话所属浏览器置前台打开(验证码人过);gotry 永不经手密码/cookie 值' });
     }
     return {
         name: 'session-search',
         routes: [
-            { method: 'GET', path: '/v1/session/status', handle: (req, res) => { if (authorized(req, res))
-                    void handleStatus(res); } },
-            { method: 'POST', path: '/v1/session/search', handle: (req, res) => { if (authorized(req, res))
-                    void handleSearch(req, res); } },
-            { method: 'POST', path: '/v1/session/login/open', handle: (req, res) => { if (authorized(req, res))
-                    void handleLoginOpen(req, res); } },
-            // 桥协议端点:远程扩展经 bearer 鉴权连入;Origin 白名单在队列处理器内再校验一道
-            { method: 'GET', path: '/v1/session/bridge/health', handle: (req, res) => { if (authorized(req, res))
-                    queue.handleMountedRequest(req, res); } },
-            { method: 'GET', path: '/v1/session/bridge/status', handle: (req, res) => { if (authorized(req, res))
-                    queue.handleMountedRequest(req, res); } },
-            { method: 'POST', path: '/v1/session/bridge/jobs', handle: (req, res) => { if (authorized(req, res))
-                    queue.handleMountedRequest(req, res); } },
-            { method: 'POST', path: '/v1/session/bridge/results', handle: (req, res) => { if (authorized(req, res))
-                    queue.handleMountedRequest(req, res); } },
+            { method: 'GET', path: '/v1/session/status', handle: (req, res) => withOrganization(req, res, (organization) => { void handleStatus(res, organization); }) },
+            { method: 'POST', path: '/v1/session/search', handle: (req, res) => withOrganization(req, res, (organization) => { void handleSearch(req, res, organization); }) },
+            { method: 'POST', path: '/v1/session/login/open', handle: (req, res) => withOrganization(req, res, (organization) => { void handleLoginOpen(req, res, organization); }) },
+            // 桥协议端点:远程扩展经 bearer 鉴权连入;Origin 白名单在队列处理器内再校验一道;组织由宿主解出后传入队列
+            { method: 'GET', path: '/v1/session/bridge/health', handle: (req, res) => withOrganization(req, res, (organization) => queue.handleMountedRequest(req, res, bridgeCaller(organization))) },
+            { method: 'GET', path: '/v1/session/bridge/status', handle: (req, res) => withOrganization(req, res, (organization) => queue.handleMountedRequest(req, res, bridgeCaller(organization))) },
+            { method: 'POST', path: '/v1/session/bridge/jobs', handle: (req, res) => withOrganization(req, res, (organization) => queue.handleMountedRequest(req, res, bridgeCaller(organization))) },
+            { method: 'POST', path: '/v1/session/bridge/results', handle: (req, res) => withOrganization(req, res, (organization) => queue.handleMountedRequest(req, res, bridgeCaller(organization))) },
             // 事件上行(批次 B):bearer + Origin 白名单双校验与 /jobs 同链,处理器内落 bridge_events
-            { method: 'POST', path: BRIDGE_EVENTS_PATH, handle: (req, res) => { if (authorized(req, res))
-                    void handleBridgeEvents(req, res); } },
+            { method: 'POST', path: BRIDGE_EVENTS_PATH, handle: (req, res) => withOrganization(req, res, (organization) => { void handleBridgeEvents(req, res, organization); }) },
         ],
         close: () => queue.close().then(() => { ledger?.close(); }),
     };