@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/security/UserOrgsContext.js

@@ -1,18 +1,22 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useState, useMemo, useEffect, useCallback, useRef } from 'react';
-import { CoreResourceType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ResourceOperationVariantType, OPERATION_VARIANT_KEY, SessionType, normalizeConsentPurposes, } from '@wildo-ai/saas-models';
+import { createContext, useState, useMemo, useEffect, useCallback, useRef, useContext } from 'react';
+import { CoreResourceType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ResourceOperationVariantType, OPERATION_VARIANT_KEY, SessionType, normalizeConsentPurposes, UserSelf_Operations, } from '@wildo-ai/saas-models';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
 import { useEventBus } from '../../core/events/useEventBus.js';
 import { FrontendEvents, SessionEndReason } from '../../core/events/events.frontend.schemas.js';
 import { useAuthSession } from './useAuthSession.js';
 import { AuthSessionUtils } from './auth-session.utils.js';
-import { isTransientBackendFailure } from '../../core/requests/auth-refresh-resilience.frontend.js';
+import { accessProfileConfersOrganization, membershipRolesFromAccessProfile } from './effective-permissions.frontend.utils.js';
+import { isTransientBackendFailure, sessionEndReasonForRefusal } from '../../core/requests/auth-refresh-resilience.frontend.js';
 import { decodeJwtPayload } from './jwt.frontend.utils.js';
 import { useAppScope } from '../../core/scope/useAppScope.js';
 import { useAppScopeInternal } from '../../core/scope/AppScopeContext.js';
 import { ScopeUtilsService } from '../../core/scope/scope.utils.frontend.service.js';
-import { findDefaultApiReadOperation } from './route-organization-access.frontend.utils.js';
+import { findDefaultApiReadOperation, hasActiveMembershipInOrganization } from './route-organization-access.frontend.utils.js';
+import { ScopeChangeInitiator } from '../../core/scope/scope.frontend.schemas.js';
+import { deriveRegionalReaderStanding } from '../../core/i18n/regional-preference-resolution.frontend.utils.js';
+import { RegionalReaderStandingPublisherContext } from '../../core/i18n/I18nContext.js';
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('UserOrgsContext');
 logger.setDebugTypeLogging('UserOrgsContext', false);
@@ -44,6 +48,9 @@ export const UserOrgsProvider = ({ children }) => {
     const appScope = useAppScope();
     const { commitOrganizationScopeValue } = useAppScopeInternal();
     const currentOrganizationId = appScope.currentOrganizationId;
+    // Read by `loadOrganizations` at the moment it settles, not when it was created: it awaits network reads.
+    const currentOrganizationIdRef = useRef(currentOrganizationId);
+    currentOrganizationIdRef.current = currentOrganizationId;
     const hasInitializedRef = useRef(false);
     const previousTokenRef = useRef(null);
     // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an
@@ -52,6 +59,9 @@ export const UserOrgsProvider = ({ children }) => {
     const restoreAbortRef = useRef(false);
     const restoreRetryTimerRef = useRef(null);
     const [user, setUser] = useState(null);
+    // The person loaded now, read by work that settles after an await (an organization loaded on demand, #2275).
+    const loadedUserIdRef = useRef(null);
+    loadedUserIdRef.current = user?._id ?? null;
     const [organizations, setOrganizations] = useState([]);
     const [permissions, setPermissions] = useState(null);
     const [privacy, setPrivacy] = useState(null);
@@ -194,6 +204,30 @@ export const UserOrgsProvider = ({ children }) => {
         // Emit preference change event to notify parent contexts
         emitPreferencesChanged(preferences, currentOrganizationPreferences);
     }, [currentOrganizationId, emitPreferencesChanged, organizations]);
+    /**
+     * The caller's access profile (`user-self | access_profile`, #2381) — the role entries the backend authorizes this
+     * person with, unit and relationship grants included, and which resources narrow by unit. The shell's
+     * visibility decisions read it (`viewerMayPerformOperation`). `null` when the operation is absent or the read fails.
+     *
+     * The route names no user: the backend answers from the request's own execution context, so it can only ever describe
+     * the person asking (`GET /user-self/access-profile/count`).
+     */
+    const loadAccessProfile = async () => {
+        const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];
+        const accessProfileOperation = userSelfConfig?.operations.find((op) => op.operationIdentifier === UserSelf_Operations.ACCESS_PROFILE &&
+            op.variantType === ResourceOperationVariantType.API_CALL &&
+            op.isBulkOperation !== true);
+        if (!accessProfileOperation)
+            return null;
+        try {
+            const operationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(accessProfileOperation);
+            return (await doOperation(operationPath, { contextualParameters: {} })) ?? null;
+        }
+        catch (error) {
+            logger.warn('Access profile could not be loaded; entries reached only through an organization-unit grant stay hidden', { error });
+            return null;
+        }
+    };
     /**
      * Compute effective permissions from user's app roles and organization roles
      * This is a basic implementation - can be enhanced based on role hierarchy
@@ -211,12 +245,109 @@ export const UserOrgsProvider = ({ children }) => {
         return {
             appLevel,
             organizations: organizationsPermissions,
+            accessProfile: null,
         };
     };
+    /**
+     * One of the person's own organizations, as the session holds it: the organization READ and, beside it, the tenant's
+     * preference record. `null` when the organization cannot be read (a refusal, a transient failure, no READ mounted).
+     *
+     * Shared by `loadOrganizations` (the memberships the user context carries) and by the organizations loaded ON
+     * DEMAND (#2275): a membership past the user context's cap that the session follows or starts in. Both must hold
+     * the organization the same way, or the switcher and the i18n preferences would differ by how it arrived.
+     */
+    const fetchOwnOrganization = useCallback(async (organizationId) => {
+        const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];
+        if (!organizationsConfig) {
+            logger.warn('ORGANIZATIONS resource not available');
+            return null;
+        }
+        // Shared with the route organization-access probe, which must address the same READ.
+        const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);
+        if (!orgsReadOp) {
+            logger.warn('ORGANIZATIONS READ operation not found');
+            return null;
+        }
+        const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);
+        /**
+         * The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an
+         * omission (#563).
+         *
+         * `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`
+         * is a CAST — nothing validates the response against it — so the field read as available
+         * while no producer existed: the ORGANIZATIONS **default** READ returns a plain
+         * `Organization`, and the organisation's regional block therefore never reached
+         * `I18nContext`. Every date and number in every generated application formatted at the
+         * framework floor as a result.
+         *
+         * The rejected alternative was to switch this call to the ORGANIZATIONS **context** variant,
+         * which does populate the child. Measured against the running stack on 2026-09-10, that
+         * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,
+         * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an
+         * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since
+         * taken the audit and delivery logs off the context surface and capped every 1:many child at
+         * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant
+         * data per membership, so the reasoning stands.) The
+         * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,
+         * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.
+         *
+         * Best-effort by construction: a tenant whose preferences cannot be read still yields a
+         * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes
+         * nothing to the i18n event rather than clearing the member's own settings.
+         */
+        const organizationPreferencesReadOp = findDefaultApiReadOperation(registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES]);
+        const fetchOrganizationPreferences = async () => {
+            // Absent READ: reported once per list load by `loadOrganizations`, not once per organization.
+            if (!organizationPreferencesReadOp)
+                return undefined;
+            try {
+                return await doOperation(ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp), { contextualParameters: { organizationId } }) ?? undefined;
+            }
+            catch (error) {
+                logger.warn('Failed to fetch organization preferences', { organizationId, error });
+                return undefined;
+            }
+        };
+        try {
+            const [org, preferences] = await Promise.all([
+                doOperation(organizationsOperationPath, { contextualParameters: { organizationId } }),
+                fetchOrganizationPreferences(),
+            ]);
+            if (!org)
+                return null;
+            // OMIT the key when the read failed rather than attaching `null`. The payload builder
+            // reads the two differently: `undefined`/absent contributes nothing to the i18n event,
+            // while `null` means "the tenant has cleared its preferences" and actively resets the
+            // organisation half — which would silently downgrade a member to the framework floor
+            // because one request failed.
+            return preferences ? { ...org, preferences } : org;
+        }
+        catch (error) {
+            logger.warn('Failed to fetch organization', { organizationId, error });
+            return null;
+        }
+    }, [doOperation, registry]);
+    /**
+     * Load one of the person's own organizations the session does not hold yet, and add it to `organizations` (#2275,
+     * #2452): one followed by route, or one the switcher found by search past the user context's first 20 memberships.
+     * One path for both, so an organization arrives the same way whichever door admitted it. A sign-out or another
+     * person's sign-in while the read was in flight must not receive this person's organization.
+     */
+    const loadOrganizationOnDemand = useCallback((organizationId) => {
+        const requestingUserId = loadedUserIdRef.current;
+        void fetchOwnOrganization(organizationId).then((organization) => {
+            if (!organization || loadedUserIdRef.current !== requestingUserId)
+                return;
+            setOrganizations((previous) => previous.some((existing) => existing._id === organization._id) ? previous : [...previous, organization]);
+        });
+    }, [fetchOwnOrganization]);
     /**
      * Load organizations independently (can be called separately from authentication)
      */
     const loadOrganizations = useCallback(async (userContext) => {
+        // The backend's own account of this person's access (#2381), fetched beside the organizations rather than after
+        // them. Best-effort: a failure leaves the shell deciding on membership roles alone (unit-granted entries hidden).
+        const accessProfilePromise = loadAccessProfile();
         const allMemberships = userContext.organizationMembers || [];
         // W7.3b: For one-off sessions, restrict to the scoped organization only
         const scopedOrgId = auth.sessionType === SessionType.ONE_OFF
@@ -230,101 +361,54 @@ export const UserOrgsProvider = ({ children }) => {
             membershipCount: memberships.length,
             isOneOff: auth.sessionType === SessionType.ONE_OFF,
         });
-        const organizationsList = [];
-        if (memberships.length > 0) {
-            const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];
-            if (!organizationsConfig) {
-                logger.warn('ORGANIZATIONS resource not available');
-                return { organizationsList, selectedOrgId: null };
-            }
-            // Shared with the route organization-access probe, which must address the same READ.
-            const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);
-            if (!orgsReadOp) {
-                logger.warn('ORGANIZATIONS READ operation not found');
-                return { organizationsList, selectedOrgId: null };
-            }
-            const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);
-            /**
-             * The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an
-             * omission (#563).
-             *
-             * `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`
-             * is a CAST — nothing validates the response against it — so the field read as available
-             * while no producer existed: the ORGANIZATIONS **default** READ returns a plain
-             * `Organization`, and the organisation's regional block therefore never reached
-             * `I18nContext`. Every date and number in every generated application formatted at the
-             * framework floor as a result.
-             *
-             * The rejected alternative was to switch this call to the ORGANIZATIONS **context** variant,
-             * which does populate the child. Measured against the running stack on 2026-09-10, that
-             * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,
-             * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an
-             * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since
-             * taken the audit and delivery logs off the context surface and capped every 1:many child at
-             * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant
-             * data per membership, so the reasoning stands.) The
-             * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,
-             * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.
-             *
-             * Best-effort by construction: a tenant whose preferences cannot be read still yields a
-             * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes
-             * nothing to the i18n event rather than clearing the member's own settings.
-             */
-            const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];
-            const organizationPreferencesReadOp = findDefaultApiReadOperation(organizationPreferencesConfig);
-            if (!organizationPreferencesReadOp) {
-                logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');
-            }
-            const organizationPreferencesOperationPath = organizationPreferencesReadOp
-                ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)
-                : null;
-            const fetchOrganizationPreferences = async (organizationId) => {
-                if (!organizationPreferencesOperationPath)
-                    return undefined;
-                try {
-                    return await doOperation(organizationPreferencesOperationPath, { contextualParameters: { organizationId } }) ?? undefined;
-                }
-                catch (error) {
-                    logger.warn('Failed to fetch organization preferences', { organizationId, error });
-                    return undefined;
-                }
-            };
-            const orgPromises = memberships.map(async (membership) => {
-                try {
-                    const [org, preferences] = await Promise.all([
-                        doOperation(organizationsOperationPath, { contextualParameters: { organizationId: membership.organizationId } }),
-                        fetchOrganizationPreferences(membership.organizationId),
-                    ]);
-                    if (!org)
-                        return null;
-                    // OMIT the key when the read failed rather than attaching `null`. The payload builder
-                    // reads the two differently: `undefined`/absent contributes nothing to the i18n event,
-                    // while `null` means "the tenant has cleared its preferences" and actively resets the
-                    // organisation half — which would silently downgrade a member to the framework floor
-                    // because one request failed.
-                    return preferences ? { ...org, preferences } : org;
-                }
-                catch (error) {
-                    logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });
-                    return null;
-                }
-            });
-            const orgResults = await Promise.all(orgPromises);
-            organizationsList.push(...orgResults.filter((org) => org !== null));
+        if (!findDefaultApiReadOperation(registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES])) {
+            logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');
         }
-        // Restore current organization selection
+        const organizationsList = [];
+        const membershipOrganizationResults = await Promise.all(memberships.map((membership) => fetchOwnOrganization(String(membership.organizationId))));
+        organizationsList.push(...membershipOrganizationResults.filter((org) => org !== null));
+        // Keep the organization this tab is IN when it is still one of the person's (#2247): a reload of the list
+        // (`refreshOrganizations`, e.g. after accepting an invitation) must not move the tab. The stored value is
+        // shared by every tab and follows each tab's route, so reading it here would pull this tab into whatever
+        // organization another tab last opened, and the switch would send it home. The stored value is the default a
+        // session STARTS from (during restore AppScope exposes no organization yet, so it is the one used), then the
+        // first organization.
+        const tabOrgId = currentOrganizationIdRef.current;
         const storedOrgId = tokenStorage.getOrganizationId();
-        const selectedOrgId = storedOrgId && organizationsList.find(o => o._id === storedOrgId)
-            ? storedOrgId
-            : organizationsList[0]?._id || null;
-        // Compute effective permissions from roles
-        const computedPermissions = computeEffectivePermissions(userContext, organizationsList);
+        const isLoaded = (organizationId) => !!organizationId && organizationsList.some(o => o._id === organizationId);
+        const accessProfile = await accessProfilePromise;
+        // The organization the tab is in, or the session starts from, may be one the user context does not carry: its
+        // `organizationMembers` holds only the newest 20 memberships (#2275), and since #2247 the tab's and the stored
+        // organization follow the route, so they are often one past that cap. When the backend's access profile confers
+        // entries there, it is one of the person's own and is loaded on demand like the others; without that, a reload
+        // of the list would move the tab out of the organization its page names, and a new session would never start
+        // where the person last was. In a one-off session only the organization its token is bound to is ever loaded.
+        const preferredOrgId = tabOrgId ?? storedOrgId;
+        if (preferredOrgId
+            && !isLoaded(preferredOrgId)
+            && (!scopedOrgId || preferredOrgId === scopedOrgId)
+            && accessProfileConfersOrganization(accessProfile, preferredOrgId)) {
+            const preferredOrganization = await fetchOwnOrganization(preferredOrgId);
+            if (preferredOrganization)
+                organizationsList.push(preferredOrganization);
+        }
+        const selectedOrgId = isLoaded(tabOrgId)
+            ? tabOrgId
+            : isLoaded(storedOrgId)
+                ? storedOrgId
+                : organizationsList[0]?._id || null;
+        // Compute effective permissions. With the backend's access profile, the roles are the ones the backend confers
+        // (`membershipRolesFromAccessProfile`); without it, the membership rows decide, as before.
+        const membershipPermissions = computeEffectivePermissions(userContext, organizationsList);
+        const computedPermissions = membershipPermissions
+            ? { ...membershipPermissions, ...(accessProfile ? membershipRolesFromAccessProfile(accessProfile) : {}), accessProfile }
+            : null;
         setOrganizations(organizationsList);
         commitOrganizationScopeValue(selectedOrgId);
         setPermissions(computedPermissions);
         logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });
         return { organizationsList, selectedOrgId };
-    }, [commitOrganizationScopeValue, doOperation, registry, tokenStorage, auth.sessionType]);
+    }, [commitOrganizationScopeValue, fetchOwnOrganization, registry, tokenStorage, auth.sessionType]);
     /**
      * Restore regular user session
      */
@@ -347,8 +431,7 @@ export const UserOrgsProvider = ({ children }) => {
         // Find context variant (auto-generated with relationship population)
         const readContextOp = userSelfConfig.operations.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
             op.isBulkOperation !== true &&
-            (op.variantType === ResourceOperationVariantType.API_CALL ||
-                op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK) &&
+            op.variantType === ResourceOperationVariantType.API_CALL &&
             op.variantKey === OPERATION_VARIANT_KEY.CONTEXT);
         if (!readContextOp) {
             logger.warn('USER_SELF context variant not found');
@@ -421,7 +504,7 @@ export const UserOrgsProvider = ({ children }) => {
      * backend returns. Genuine authentication (401), authorization (403), and
      * non-network errors terminate immediately (no retry on a dead-or-buggy path).
      */
-    const restoreSession = useCallback(async () => {
+    const runSessionRestore = useCallback(async () => {
         logDebug('Restoring session from stored token');
         // Check if session is already restored to avoid duplicate restoration attempts
         if (auth.sessionRestored && auth.accessToken && user) {
@@ -515,7 +598,8 @@ export const UserOrgsProvider = ({ children }) => {
                         errorType: error?.wildoError?.type || error?.response?.data?.error?.type,
                         status: error?.response?.status,
                     });
-                    endSession(SessionEndReason.SESSION_ENDED);
+                    // Usually the refresh already ended it, naming why; when restore is first, it reads the refusal itself.
+                    endSession(sessionEndReasonForRefusal(error));
                     return false;
                 }
                 // Fail closed on unexpected NON-transient errors. A partially restored
@@ -541,6 +625,27 @@ export const UserOrgsProvider = ({ children }) => {
         connectWebSocket,
         tokenStorage
     ]);
+    /**
+     * The access token the last restore CONCLUDED for, whatever its outcome (#2242).
+     *
+     * "A token and no user" is two different states, and the reader standing must tell them apart: before a
+     * restore has run for this token (every returning visitor's first render, and a one-off session, which
+     * starts with `sessionRestored: true` and no user) it is UNSETTLED; after a restore concluded without a
+     * user (the authorization-error branch keeps the token) it is settled with no person. Neither
+     * `isRestoringSession` nor `sessionRestored` says which — so the restore records it. Keyed by the token
+     * LIVE at the end, since a restore may rotate it mid-flight.
+     */
+    const [restoreConcludedForToken, setRestoreConcludedForToken] = useState(null);
+    const restoreSession = useCallback(async () => {
+        try {
+            return await runSessionRestore();
+        }
+        finally {
+            const settledToken = tokenStorage.getAccessToken();
+            if (settledToken)
+                setRestoreConcludedForToken(settledToken);
+        }
+    }, [runSessionRestore, tokenStorage]);
     /**
      * Refresh organizations data (e.g., after organization update)
      */
@@ -564,24 +669,87 @@ export const UserOrgsProvider = ({ children }) => {
             : null;
         emitPreferencesChanged(user.userSelfPreferences, currentOrganization?.preferences);
     }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);
+    /*
+     * Whether anybody is reading, published to `I18nContext` (#2242). It mounts above this provider, so a null
+     * member and a null organization are all it can see — the same for an anonymous visitor as for a member
+     * being restored, and only the first should have the browser stand in for their preferences.
+     *
+     * Through `RegionalReaderStandingPublisherContext`, never the bus: `I18nProvider` is our ancestor, so its
+     * bus subscription is made AFTER our mount effect runs, and an emission there is lost (see the context's
+     * JSDoc). ONE effect, deriving from the session rather than riding each preference emission above: every
+     * way a session starts or ends changes one of these inputs, so none can forget to say it. Declared AFTER
+     * the preferences effect so a member's SIGNED_IN follows their preferences in the same commit; the restore
+     * path stores them before `isRestoringSession` clears, so it is ordered by the derivation itself.
+     */
+    const publishRegionalReaderStanding = useContext(RegionalReaderStandingPublisherContext);
+    const regionalReaderStanding = deriveRegionalReaderStanding({
+        isRestoringSession: auth.isRestoringSession,
+        hasUser: user !== null,
+        hasAccessToken: Boolean(auth.accessToken),
+        restoreConcludedForAccessToken: Boolean(auth.accessToken) && restoreConcludedForToken === auth.accessToken,
+    });
+    useEffect(() => {
+        publishRegionalReaderStanding?.(regionalReaderStanding);
+    }, [publishRegionalReaderStanding, regionalReaderStanding]);
     /**
      * Set the current active organization
      */
     const setCurrentOrganization = useCallback((organizationId) => {
-        // Validate that organization exists in user's organizations
         const org = organizations.find(o => o._id === organizationId);
-        if (!org) {
+        // An organization the switcher FOUND by search rather than one it loaded (#2452): past the user context's first
+        // 20 memberships. Admitted on the same fact `followRouteOrganization` admits it on — the backend's access profile
+        // confers entries there — and loaded on demand like a followed one, so the switcher and the tenant's preferences
+        // hold it the same way. Never in a one-off session, whose token the server bound to one organization.
+        const conferred = !org
+            && auth.sessionType !== SessionType.ONE_OFF
+            && accessProfileConfersOrganization(permissions?.accessProfile, organizationId);
+        if (!org && !conferred) {
             logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });
             return;
         }
+        if (conferred)
+            loadOrganizationOnDemand(organizationId);
         const previousOrganizationId = currentOrganizationId;
         // Skip if the organization hasn't changed
         if (previousOrganizationId === organizationId) {
             return;
         }
-        logDebug('Setting current organization', { organizationId, organizationName: org.name, previousOrganizationId });
-        commitOrganizationScopeValue(organizationId);
-    }, [organizations, currentOrganizationId, commitOrganizationScopeValue]);
+        logDebug('Setting current organization', { organizationId, organizationName: org?.name, previousOrganizationId, loadedOnDemand: conferred });
+        commitOrganizationScopeValue(organizationId, ScopeChangeInitiator.USER_SELECTION);
+    }, [auth.sessionType, organizations, permissions, currentOrganizationId, commitOrganizationScopeValue, loadOrganizationOnDemand]);
+    /**
+     * Follow the organization the route names (#2247).
+     *
+     * Three facts admit it, matching the route verdicts the follow acts on. An ACTIVE membership the client vouches for
+     * is what `ACTIVE_MEMBERSHIP` rests on, so the two cannot disagree. An organization in `organizations` is one this
+     * session loaded from its own memberships and offers in the switcher; it is what admits a representative member
+     * (#1597), whose membership the client deliberately never vouches for and the server `ADMITTED`. An organization the
+     * backend's access profile confers entries in is a membership past the user context's cap of 20 (#2275), which the
+     * server also `ADMITTED`: it is loaded on demand, so the switcher and the tenant's preferences hold the organization
+     * the person is in. Anything else — a platform operator's crossing, a foreign organization — is refused.
+     *
+     * The commit does not wait for that load. The roles the page is judged by come from the access profile, which is
+     * already held, and holding the route's content until a second read lands would only delay a page that can render.
+     */
+    const followRouteOrganization = useCallback((organizationId) => {
+        if (auth.sessionType === SessionType.ONE_OFF) {
+            return false;
+        }
+        const loaded = organizations.some((organization) => organization._id === organizationId);
+        const conferred = accessProfileConfersOrganization(permissions?.accessProfile, organizationId);
+        const sessionCanBeIn = hasActiveMembershipInOrganization(user?.organizationMembers, organizationId) || loaded || conferred;
+        if (!sessionCanBeIn) {
+            logger.warn('Refused to follow a route organization this session cannot be in', { organizationId });
+            return false;
+        }
+        if (!loaded)
+            loadOrganizationOnDemand(organizationId);
+        if (currentOrganizationId !== organizationId) {
+            logDebug('Following the route organization', { organizationId, previousOrganizationId: currentOrganizationId });
+            commitOrganizationScopeValue(organizationId, ScopeChangeInitiator.ROUTER);
+        }
+        return true;
+    }, [auth.sessionType, user, organizations, permissions, currentOrganizationId, commitOrganizationScopeValue, loadOrganizationOnDemand]);
     /**
      * Get the current active organization
      */
@@ -604,8 +772,7 @@ export const UserOrgsProvider = ({ children }) => {
         const operation = registry.resourceConfigurations[CoreResourceType.USER_SELF_PREFERENCES]?.operations.find((candidate) => candidate.operationIdentifier === CoreResourceOperation.UPDATE
             && candidate.isOperationDefault === true
             && candidate.isBulkOperation !== true
-            && (candidate.variantType === ResourceOperationVariantType.API_CALL
-                || candidate.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+            && (candidate.variantType === ResourceOperationVariantType.API_CALL));
         if (!operation) {
             throw new Error('Cannot record a consent decision: this application mounts no user self-preferences UPDATE operation');
         }
@@ -727,6 +894,7 @@ export const UserOrgsProvider = ({ children }) => {
         privacy,
         // Organization management
         setCurrentOrganization,
+        followRouteOrganization,
         getCurrentOrganization,
         refreshOrganizations,
         // Privacy getter
@@ -750,6 +918,7 @@ export const UserOrgsProvider = ({ children }) => {
         primaryScopeInitiatorIds,
         privacy,
         setCurrentOrganization,
+        followRouteOrganization,
         getCurrentOrganization,
         refreshOrganizations,
         getPrivacy,