Automation API ignores Canvas-selected X-Org-Id when resolving organization #402

Problem

When OpenHands Canvas is served under /canvas, the Canvas frontend lets users switch between organization-scoped Cloud backend entries. The automations dashboard refetches after org selection changes, but it can still show automations from the previously resolved organization.

Root cause

Canvas sends the selected organization as X-Org-Id on Cloud requests, including automation requests. The automation service authenticates each request by calling OpenHands GET /api/v1/users/me, then uses the returned org_id to scope automation queries.

However, the automation service currently forwards only Authorization or Cookie to /api/v1/users/me; it does not forward the incoming X-Org-Id. As a result, OpenHands resolves /users/me using the user’s persisted/default current org instead of the Canvas-selected org. The automation service then filters with that stale/default org:

Automation.org_id == user.org_id

The auth cache is also keyed only by credential, so even if X-Org-Id is forwarded, the cache needs to include the requested org scope to avoid reusing one org’s AuthenticatedUser for another org.

Expected behavior

Requests with X-Org-Id should authenticate and authorize against that organization, and /api/automation/v1 should list automations for the selected organization.

Proposed fix

• Forward incoming X-Org-Id when validating credentials with OpenHands /api/v1/users/me.
• Include auth method and requested org ID in the automation auth cache key.
• Add tests for X-Org-Id forwarding and org-aware cache separation.

This issue was created by an AI agent (OpenHands) on behalf of the user.