@wopr-network/platform-core 1.0.3 → 1.0.5

package/.env.example

@@ -0,0 +1,5 @@
+# Platform UI URL (used for redirect allowlist)
+# PLATFORM_UI_URL=https://platform.example.com
+
+# Extra allowed redirect origins (comma-separated, for staging/preview environments)
+# EXTRA_ALLOWED_REDIRECT_ORIGINS=https://staging.wopr.bot,https://preview.wopr.bot

package/dist/auth/better-auth.js

@@ -7,6 +7,7 @@
  * The auth instance is lazily initialized to avoid opening the database
  * at module import time (which breaks tests).
  */
+import { randomBytes } from "node:crypto";
 import { betterAuth } from "better-auth";
 import { twoFactor } from "better-auth/plugins";
 import { RoleStore } from "../admin/role-store.js";
@@ -24,6 +25,9 @@ const DEFAULT_RATE_LIMIT_RULES = {
 let _config = null;
 let _userCreator = null;
 let _userCreatorPromise = null;
+// Ephemeral secret: generated once per process, reused across authOptions() calls.
+// Hoisted to module scope so resetAuth() (which nulls _auth) does not invalidate sessions.
+let _ephemeralSecret = null;
 export async function getUserCreator() {
     if (_userCreator)
         return _userCreator;
@@ -65,8 +69,10 @@ function authOptions(cfg) {
         if (process.env.NODE_ENV === "production") {
             throw new Error("BETTER_AUTH_SECRET is required in production");
         }
-        logger.warn("BetterAuth secret not configured — sessions may be insecure");
+        logger.warn("BetterAuth secret not configured — sessions will be invalidated on restart");
     }
+    _ephemeralSecret ??= randomBytes(32).toString("hex");
+    const effectiveSecret = secret || _ephemeralSecret;
     const baseURL = cfg.baseURL || process.env.BETTER_AUTH_URL || "http://localhost:3100";
     const basePath = cfg.basePath || "/api/auth";
     const cookieDomain = cfg.cookieDomain || process.env.COOKIE_DOMAIN;
@@ -81,7 +87,7 @@ function authOptions(cfg) {
         : { enabled: true, minPasswordLength: 12 };
     return {
         database: pool,
-        secret: secret || "",
+        secret: effectiveSecret,
         baseURL,
         basePath,
         socialProviders: resolveSocialProviders(cfg),

package/dist/db/index.d.ts

@@ -11,4 +11,6 @@ export type PlatformDb = PgDatabase<PgQueryResultHKT, PlatformSchema>;
 /** Create a Drizzle database instance wrapping the given pg.Pool. */
 export declare function createDb(pool: Pool): PlatformDb;
 export { schema };
+export type { AuthUser, IAuthUserRepository } from "./auth-user-repository.js";
+export { BetterAuthUserRepository } from "./auth-user-repository.js";
 export { creditColumn } from "./credit-column.js";

package/dist/db/index.js

@@ -5,4 +5,5 @@ export function createDb(pool) {
     return drizzle(pool, { schema });
 }
 export { schema };
+export { BetterAuthUserRepository } from "./auth-user-repository.js";
 export { creditColumn } from "./credit-column.js";

package/dist/security/redirect-allowlist.js

@@ -1,10 +1,29 @@
 const STATIC_ORIGINS = ["https://app.wopr.bot", "https://wopr.network"];
+function parseExtraOrigins() {
+    const raw = process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS;
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .filter((entry) => {
+        try {
+            new URL(entry);
+            return true;
+        }
+        catch {
+            console.warn(`[redirect-allowlist] Malformed entry in EXTRA_ALLOWED_REDIRECT_ORIGINS, skipping: ${entry}`);
+            return false;
+        }
+    });
+}
 function getAllowedOrigins() {
     return [
         ...STATIC_ORIGINS,
         ...(process.env.NODE_ENV !== "production" ? ["http://localhost:3000", "http://localhost:3001"] : []),
         ...(process.env.PLATFORM_UI_URL ? [process.env.PLATFORM_UI_URL] : []),
-        ...(process.env.NODE_ENV !== "production" ? ["https://example.com"] : []),
+        ...(process.env.NODE_ENV !== "production" ? parseExtraOrigins() : []),
     ];
 }
 /**

package/dist/security/redirect-allowlist.test.js

@@ -34,6 +34,40 @@ describe("assertSafeRedirectUrl", () => {
     it("rejects empty string", () => {
         expect(() => assertSafeRedirectUrl("")).toThrow("Invalid redirect URL");
     });
+    it("rejects https://example.com", () => {
+        expect(() => assertSafeRedirectUrl("https://example.com/callback")).toThrow("Invalid redirect URL");
+    });
+    describe("EXTRA_ALLOWED_REDIRECT_ORIGINS env-driven entries", () => {
+        beforeEach(() => {
+            vi.resetModules();
+        });
+        afterEach(() => {
+            delete process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS;
+            vi.resetModules();
+        });
+        it("allows origins listed in EXTRA_ALLOWED_REDIRECT_ORIGINS", async () => {
+            process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS = "https://staging.wopr.bot";
+            const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+            expect(() => assertSafe("https://staging.wopr.bot/billing")).not.toThrow();
+        });
+        it("allows multiple comma-separated origins", async () => {
+            process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS = "https://staging.wopr.bot,https://preview.wopr.bot";
+            const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+            expect(() => assertSafe("https://staging.wopr.bot/billing")).not.toThrow();
+            expect(() => assertSafe("https://preview.wopr.bot/dashboard")).not.toThrow();
+        });
+        it("ignores empty/whitespace entries in comma-separated list", async () => {
+            process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS = "https://staging.wopr.bot, , ,";
+            const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+            expect(() => assertSafe("https://staging.wopr.bot/billing")).not.toThrow();
+            expect(() => assertSafe("https://evil.com/phishing")).toThrow("Invalid redirect URL");
+        });
+        it("defaults to empty when env var is unset", async () => {
+            delete process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS;
+            const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+            expect(() => assertSafe("https://random.example.org")).toThrow("Invalid redirect URL");
+        });
+    });
     describe("PLATFORM_UI_URL env-driven entry", () => {
         beforeEach(() => {
             process.env.PLATFORM_UI_URL = "https://platform.example.com";

package/dist/tenancy/org-service.d.ts

@@ -3,6 +3,7 @@
  * role changes, and org CRUD. Depends on IOrgRepository (tenant data) and
  * IOrgMemberRepository (members/invites data).
  */
+import type { IAuthUserRepository } from "../db/auth-user-repository.js";
 import type { PlatformDb } from "../db/index.js";
 import type { IOrgRepository, Tenant } from "./drizzle-org-repository.js";
 import type { IOrgMemberRepository, OrgInviteRow } from "./org-member-repository.js";
@@ -29,12 +30,15 @@ export interface OrgInvitePublic {
 export interface OrgServiceOptions {
     /** Hook called inside deleteOrg transaction before members/invites/tenant rows are deleted. */
     onBeforeDeleteOrg?: (orgId: string, tx: PlatformDb) => Promise<void>;
+    /** Optional user profile resolver for populating member name/email. */
+    userRepo?: IAuthUserRepository;
 }
 export declare class OrgService {
     private readonly orgRepo;
     private readonly memberRepo;
     private readonly db;
     private readonly onBeforeDeleteOrg?;
+    private readonly userRepo?;
     constructor(orgRepo: IOrgRepository, memberRepo: IOrgMemberRepository, db: PlatformDb, options?: OrgServiceOptions);
     /**
      * Return the personal org for the user, creating it if it doesn't exist.

package/dist/tenancy/org-service.js

@@ -13,11 +13,13 @@ export class OrgService {
     memberRepo;
     db;
     onBeforeDeleteOrg;
+    userRepo;
     constructor(orgRepo, memberRepo, db, options) {
         this.orgRepo = orgRepo;
         this.memberRepo = memberRepo;
         this.db = db;
         this.onBeforeDeleteOrg = options?.onBeforeDeleteOrg;
+        this.userRepo = options?.userRepo;
     }
     /**
      * Return the personal org for the user, creating it if it doesn't exist.
@@ -188,16 +190,32 @@ export class OrgService {
     async buildOrgWithMembers(tenant) {
         const members = await this.memberRepo.listMembers(tenant.id);
         const invites = await this.memberRepo.listInvites(tenant.id);
+        // Batch-resolve user profiles when a userRepo is available.
+        let profileMap;
+        const userRepo = this.userRepo;
+        if (userRepo) {
+            const results = await Promise.allSettled(members.map((m) => userRepo.getUser(m.userId)));
+            profileMap = new Map();
+            for (let i = 0; i < members.length; i++) {
+                const result = results[i];
+                if (result.status === "fulfilled" && result.value) {
+                    profileMap.set(members[i].userId, { name: result.value.name, email: result.value.email });
+                }
+            }
+        }
         return {
             ...tenant,
-            members: members.map((m) => ({
-                id: m.id,
-                userId: m.userId,
-                name: m.userId, // name resolved from user context (placeholder until user profile lookup wired)
-                email: "", // email resolved from user context (placeholder)
-                role: m.role,
-                joinedAt: new Date(m.joinedAt).toISOString(),
-            })),
+            members: members.map((m) => {
+                const resolved = profileMap?.get(m.userId);
+                return {
+                    id: m.id,
+                    userId: m.userId,
+                    name: resolved?.name ?? m.userId,
+                    email: resolved?.email ?? "",
+                    role: m.role,
+                    joinedAt: new Date(m.joinedAt).toISOString(),
+                };
+            }),
             invites: invites.map((i) => ({
                 id: i.id,
                 email: i.email,

package/dist/tenancy/org-service.test.js

@@ -547,4 +547,70 @@ describe("OrgService", () => {
             await expect(svc.removeMember(org.id, owner, admin)).resolves.not.toThrow();
         });
     });
+    describe("buildOrgWithMembers member resolution", () => {
+        it("resolves member name and email from userRepo when provided", async () => {
+            await pool.query(`CREATE TABLE IF NOT EXISTS "user" (id TEXT PRIMARY KEY, name TEXT, email TEXT, image TEXT, "twoFactorEnabled" BOOLEAN DEFAULT false)`);
+            await pool.query(`INSERT INTO "user" (id, name, email) VALUES ($1, $2, $3) ON CONFLICT (id) DO UPDATE SET name = $2, email = $3`, ["resolve-user-1", "Alice Smith", "alice@example.com"]);
+            const { orgRepo, memberRepo } = await setup(db);
+            const userRepo = {
+                getUser: async (userId) => {
+                    const { rows } = await pool.query(`SELECT id, name, email, image, "twoFactorEnabled" FROM "user" WHERE id = $1`, [userId]);
+                    return rows[0] ?? null;
+                },
+                updateUser: vi.fn(),
+                changePassword: vi.fn(),
+                listAccounts: vi.fn(),
+                unlinkAccount: vi.fn(),
+            };
+            const svc = new OrgService(orgRepo, memberRepo, db, { userRepo });
+            const org = await orgRepo.createOrg("resolve-user-1", "Resolve Org", "resolve-org");
+            await memberRepo.addMember({
+                id: "m-resolve-1",
+                orgId: org.id,
+                userId: "resolve-user-1",
+                role: "owner",
+                joinedAt: Date.now(),
+            });
+            const result = await svc.getOrg(org.id);
+            expect(result.members[0].name).toBe("Alice Smith");
+            expect(result.members[0].email).toBe("alice@example.com");
+        });
+        it("falls back to userId/empty when userRepo returns null (deleted user)", async () => {
+            const { orgRepo, memberRepo } = await setup(db);
+            const userRepo = {
+                getUser: async () => null,
+                updateUser: vi.fn(),
+                changePassword: vi.fn(),
+                listAccounts: vi.fn(),
+                unlinkAccount: vi.fn(),
+            };
+            const svc = new OrgService(orgRepo, memberRepo, db, { userRepo });
+            const org = await orgRepo.createOrg("ghost-user", "Ghost Org", "ghost-org");
+            await memberRepo.addMember({
+                id: "m-ghost-1",
+                orgId: org.id,
+                userId: "ghost-user",
+                role: "owner",
+                joinedAt: Date.now(),
+            });
+            const result = await svc.getOrg(org.id);
+            expect(result.members[0].name).toBe("ghost-user");
+            expect(result.members[0].email).toBe("");
+        });
+        it("falls back to userId/empty when no userRepo is provided (backward compat)", async () => {
+            const { orgRepo, memberRepo } = await setup(db);
+            const svc = new OrgService(orgRepo, memberRepo, db); // no userRepo
+            const org = await orgRepo.createOrg("compat-user", "Compat Org", "compat-org");
+            await memberRepo.addMember({
+                id: "m-compat-1",
+                orgId: org.id,
+                userId: "compat-user",
+                role: "owner",
+                joinedAt: Date.now(),
+            });
+            const result = await svc.getOrg(org.id);
+            expect(result.members[0].name).toBe("compat-user");
+            expect(result.members[0].email).toBe("");
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wopr-network/platform-core",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -8,6 +8,7 @@
  * at module import time (which breaks tests).
  */
 
+import { randomBytes } from "node:crypto";
 import { type BetterAuthOptions, betterAuth } from "better-auth";
 import { twoFactor } from "better-auth/plugins";
 import type { Pool } from "pg";
@@ -94,6 +95,10 @@ let _config: BetterAuthConfig | null = null;
 let _userCreator: IUserCreator | null = null;
 let _userCreatorPromise: Promise<IUserCreator> | null = null;
 
+// Ephemeral secret: generated once per process, reused across authOptions() calls.
+// Hoisted to module scope so resetAuth() (which nulls _auth) does not invalidate sessions.
+let _ephemeralSecret: string | null = null;
+
 export async function getUserCreator(): Promise<IUserCreator> {
   if (_userCreator) return _userCreator;
   if (!_userCreatorPromise) {
@@ -134,8 +139,10 @@ function authOptions(cfg: BetterAuthConfig): BetterAuthOptions {
     if (process.env.NODE_ENV === "production") {
       throw new Error("BETTER_AUTH_SECRET is required in production");
     }
-    logger.warn("BetterAuth secret not configured — sessions may be insecure");
+    logger.warn("BetterAuth secret not configured — sessions will be invalidated on restart");
   }
+  _ephemeralSecret ??= randomBytes(32).toString("hex");
+  const effectiveSecret = secret || _ephemeralSecret;
   const baseURL = cfg.baseURL || process.env.BETTER_AUTH_URL || "http://localhost:3100";
   const basePath = cfg.basePath || "/api/auth";
   const cookieDomain = cfg.cookieDomain || process.env.COOKIE_DOMAIN;
@@ -152,7 +159,7 @@ function authOptions(cfg: BetterAuthConfig): BetterAuthOptions {
 
   return {
     database: pool,
-    secret: secret || "",
+    secret: effectiveSecret,
     baseURL,
     basePath,
     socialProviders: resolveSocialProviders(cfg),

package/src/db/index.ts

@@ -18,4 +18,6 @@ export function createDb(pool: Pool): PlatformDb {
 }
 
 export { schema };
+export type { AuthUser, IAuthUserRepository } from "./auth-user-repository.js";
+export { BetterAuthUserRepository } from "./auth-user-repository.js";
 export { creditColumn } from "./credit-column.js";

package/src/security/redirect-allowlist.test.ts

@@ -46,6 +46,47 @@ describe("assertSafeRedirectUrl", () => {
     expect(() => assertSafeRedirectUrl("")).toThrow("Invalid redirect URL");
   });
 
+  it("rejects https://example.com", () => {
+    expect(() => assertSafeRedirectUrl("https://example.com/callback")).toThrow("Invalid redirect URL");
+  });
+
+  describe("EXTRA_ALLOWED_REDIRECT_ORIGINS env-driven entries", () => {
+    beforeEach(() => {
+      vi.resetModules();
+    });
+
+    afterEach(() => {
+      delete process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS;
+      vi.resetModules();
+    });
+
+    it("allows origins listed in EXTRA_ALLOWED_REDIRECT_ORIGINS", async () => {
+      process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS = "https://staging.wopr.bot";
+      const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+      expect(() => assertSafe("https://staging.wopr.bot/billing")).not.toThrow();
+    });
+
+    it("allows multiple comma-separated origins", async () => {
+      process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS = "https://staging.wopr.bot,https://preview.wopr.bot";
+      const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+      expect(() => assertSafe("https://staging.wopr.bot/billing")).not.toThrow();
+      expect(() => assertSafe("https://preview.wopr.bot/dashboard")).not.toThrow();
+    });
+
+    it("ignores empty/whitespace entries in comma-separated list", async () => {
+      process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS = "https://staging.wopr.bot, , ,";
+      const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+      expect(() => assertSafe("https://staging.wopr.bot/billing")).not.toThrow();
+      expect(() => assertSafe("https://evil.com/phishing")).toThrow("Invalid redirect URL");
+    });
+
+    it("defaults to empty when env var is unset", async () => {
+      delete process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS;
+      const { assertSafeRedirectUrl: assertSafe } = await import("./redirect-allowlist.js");
+      expect(() => assertSafe("https://random.example.org")).toThrow("Invalid redirect URL");
+    });
+  });
+
   describe("PLATFORM_UI_URL env-driven entry", () => {
     beforeEach(() => {
       process.env.PLATFORM_UI_URL = "https://platform.example.com";

package/src/security/redirect-allowlist.ts

@@ -1,11 +1,29 @@
 const STATIC_ORIGINS: string[] = ["https://app.wopr.bot", "https://wopr.network"];
 
+function parseExtraOrigins(): string[] {
+  const raw = process.env.EXTRA_ALLOWED_REDIRECT_ORIGINS;
+  if (!raw) return [];
+  return raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .filter((entry) => {
+      try {
+        new URL(entry);
+        return true;
+      } catch {
+        console.warn(`[redirect-allowlist] Malformed entry in EXTRA_ALLOWED_REDIRECT_ORIGINS, skipping: ${entry}`);
+        return false;
+      }
+    });
+}
+
 function getAllowedOrigins(): string[] {
   return [
     ...STATIC_ORIGINS,
     ...(process.env.NODE_ENV !== "production" ? ["http://localhost:3000", "http://localhost:3001"] : []),
     ...(process.env.PLATFORM_UI_URL ? [process.env.PLATFORM_UI_URL] : []),
-    ...(process.env.NODE_ENV !== "production" ? ["https://example.com"] : []),
+    ...(process.env.NODE_ENV !== "production" ? parseExtraOrigins() : []),
   ];
 }
 

package/src/tenancy/org-service.test.ts

@@ -631,4 +631,88 @@ describe("OrgService", () => {
       await expect(svc.removeMember(org.id, owner, admin)).resolves.not.toThrow();
     });
   });
+
+  describe("buildOrgWithMembers member resolution", () => {
+    it("resolves member name and email from userRepo when provided", async () => {
+      await pool.query(
+        `CREATE TABLE IF NOT EXISTS "user" (id TEXT PRIMARY KEY, name TEXT, email TEXT, image TEXT, "twoFactorEnabled" BOOLEAN DEFAULT false)`,
+      );
+      await pool.query(
+        `INSERT INTO "user" (id, name, email) VALUES ($1, $2, $3) ON CONFLICT (id) DO UPDATE SET name = $2, email = $3`,
+        ["resolve-user-1", "Alice Smith", "alice@example.com"],
+      );
+
+      const { orgRepo, memberRepo } = await setup(db);
+      const userRepo = {
+        getUser: async (userId: string) => {
+          const { rows } = await pool.query<{
+            id: string;
+            name: string;
+            email: string;
+            image: string | null;
+            twoFactorEnabled: boolean;
+          }>(`SELECT id, name, email, image, "twoFactorEnabled" FROM "user" WHERE id = $1`, [userId]);
+          return rows[0] ?? null;
+        },
+        updateUser: vi.fn(),
+        changePassword: vi.fn(),
+        listAccounts: vi.fn(),
+        unlinkAccount: vi.fn(),
+      };
+      const svc = new OrgService(orgRepo, memberRepo, db, { userRepo });
+      const org = await orgRepo.createOrg("resolve-user-1", "Resolve Org", "resolve-org");
+      await memberRepo.addMember({
+        id: "m-resolve-1",
+        orgId: org.id,
+        userId: "resolve-user-1",
+        role: "owner",
+        joinedAt: Date.now(),
+      });
+
+      const result = await svc.getOrg(org.id);
+      expect(result.members[0].name).toBe("Alice Smith");
+      expect(result.members[0].email).toBe("alice@example.com");
+    });
+
+    it("falls back to userId/empty when userRepo returns null (deleted user)", async () => {
+      const { orgRepo, memberRepo } = await setup(db);
+      const userRepo = {
+        getUser: async () => null,
+        updateUser: vi.fn(),
+        changePassword: vi.fn(),
+        listAccounts: vi.fn(),
+        unlinkAccount: vi.fn(),
+      };
+      const svc = new OrgService(orgRepo, memberRepo, db, { userRepo });
+      const org = await orgRepo.createOrg("ghost-user", "Ghost Org", "ghost-org");
+      await memberRepo.addMember({
+        id: "m-ghost-1",
+        orgId: org.id,
+        userId: "ghost-user",
+        role: "owner",
+        joinedAt: Date.now(),
+      });
+
+      const result = await svc.getOrg(org.id);
+      expect(result.members[0].name).toBe("ghost-user");
+      expect(result.members[0].email).toBe("");
+    });
+
+    it("falls back to userId/empty when no userRepo is provided (backward compat)", async () => {
+      const { orgRepo, memberRepo } = await setup(db);
+      const svc = new OrgService(orgRepo, memberRepo, db); // no userRepo
+      const org = await orgRepo.createOrg("compat-user", "Compat Org", "compat-org");
+      await memberRepo.addMember({
+        id: "m-compat-1",
+        orgId: org.id,
+        userId: "compat-user",
+        role: "owner",
+        joinedAt: Date.now(),
+      });
+
+      const result = await svc.getOrg(org.id);
+      expect(result.members[0].name).toBe("compat-user");
+      expect(result.members[0].email).toBe("");
+    });
+  });
 });

package/src/tenancy/org-service.ts

@@ -8,6 +8,7 @@ import crypto from "node:crypto";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import { logger } from "../config/logger.js";
+import type { IAuthUserRepository } from "../db/auth-user-repository.js";
 import type { PlatformDb } from "../db/index.js";
 import { organizationInvites, organizationMembers, tenants } from "../db/schema/index.js";
 import type { IOrgRepository, Tenant } from "./drizzle-org-repository.js";
@@ -47,10 +48,13 @@ export interface OrgInvitePublic {
 export interface OrgServiceOptions {
   /** Hook called inside deleteOrg transaction before members/invites/tenant rows are deleted. */
   onBeforeDeleteOrg?: (orgId: string, tx: PlatformDb) => Promise<void>;
+  /** Optional user profile resolver for populating member name/email. */
+  userRepo?: IAuthUserRepository;
 }
 
 export class OrgService {
   private readonly onBeforeDeleteOrg?: (orgId: string, tx: PlatformDb) => Promise<void>;
+  private readonly userRepo?: IAuthUserRepository;
 
   constructor(
     private readonly orgRepo: IOrgRepository,
@@ -59,6 +63,7 @@ export class OrgService {
     options?: OrgServiceOptions,
   ) {
     this.onBeforeDeleteOrg = options?.onBeforeDeleteOrg;
+    this.userRepo = options?.userRepo;
   }
 
   /**
@@ -254,16 +259,34 @@ export class OrgService {
   private async buildOrgWithMembers(tenant: Tenant): Promise<OrgWithMembers> {
     const members = await this.memberRepo.listMembers(tenant.id);
     const invites = await this.memberRepo.listInvites(tenant.id);
+
+    // Batch-resolve user profiles when a userRepo is available.
+    let profileMap: Map<string, { name: string; email: string }> | undefined;
+    const userRepo = this.userRepo;
+    if (userRepo) {
+      const results = await Promise.allSettled(members.map((m) => userRepo.getUser(m.userId)));
+      profileMap = new Map();
+      for (let i = 0; i < members.length; i++) {
+        const result = results[i];
+        if (result.status === "fulfilled" && result.value) {
+          profileMap.set(members[i].userId, { name: result.value.name, email: result.value.email });
+        }
+      }
+    }
+
     return {
       ...tenant,
-      members: members.map((m) => ({
-        id: m.id,
-        userId: m.userId,
-        name: m.userId, // name resolved from user context (placeholder until user profile lookup wired)
-        email: "", // email resolved from user context (placeholder)
-        role: m.role,
-        joinedAt: new Date(m.joinedAt).toISOString(),
-      })),
+      members: members.map((m) => {
+        const resolved = profileMap?.get(m.userId);
+        return {
+          id: m.id,
+          userId: m.userId,
+          name: resolved?.name ?? m.userId,
+          email: resolved?.email ?? "",
+          role: m.role,
+          joinedAt: new Date(m.joinedAt).toISOString(),
+        };
+      }),
       invites: invites.map((i) => ({
         id: i.id,
         email: i.email,