refactor(agents-core): enforce data-access layer boundary for auth queries

package.json

@@ -121,6 +121,9 @@
     ],
     "scripts/generate-jwt-keys.sh": [
       "bash -c 'cp scripts/generate-jwt-keys.sh create-agents-template/scripts/generate-jwt-keys.sh && git add create-agents-template/scripts/generate-jwt-keys.sh'"
+    ],
+    "packages/agents-core/src/**/*.{ts,tsx}": [
+      "bash scripts/lint-data-access-boundary.sh"
     ]
   },
   "packageManager": "pnpm@10.10.0"

packages/agents-core/src/auth/auth.ts

@@ -3,34 +3,18 @@ import { type BetterAuthAdvancedOptions, betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
 import { bearer, deviceAuthorization, oAuthProxy, organization } from 'better-auth/plugins';
 import type { GoogleOptions } from 'better-auth/social-providers';
-import { eq } from 'drizzle-orm';
+import {
+  createSSOProvider,
+  getInitialOrganizationForUser,
+  getSSOProviderByProviderId,
+} from '../data-access/runtime/auth';
 import type { AgentsRunDatabaseClient } from '../db/runtime/runtime-client';
 import { env } from '../env';
 import { generateId } from '../utils';
-import * as authSchema from './auth-schema';
 import { type OrgRole, OrgRoles } from './authz/types';
 import { setPasswordResetLink } from './password-reset-link-store';
 import { ac, adminRole, memberRole, ownerRole } from './permissions';
 
-/**
- * Get the user's initial organization for a new session.
- * Returns the oldest organization the user is a member of.
- * See: https://www.better-auth.com/docs/plugins/organization#active-organization
- */
-async function getInitialOrganization(
-  dbClient: AgentsRunDatabaseClient,
-  userId: string
-): Promise<{ id: string } | null> {
-  const [membership] = await dbClient
-    .select({ organizationId: authSchema.member.organizationId })
-    .from(authSchema.member)
-    .where(eq(authSchema.member.userId, userId))
-    .orderBy(authSchema.member.createdAt)
-    .limit(1);
-
-  return membership ? { id: membership.organizationId } : null;
-}
-
 export interface OIDCProviderConfig {
   clientId: string;
   clientSecret: string;
@@ -155,28 +139,23 @@ async function registerSSOProvider(
   provider: SSOProviderConfig
 ): Promise<void> {
   try {
-    const existing = await dbClient
-      .select()
-      .from(authSchema.ssoProvider)
-      .where(eq(authSchema.ssoProvider.providerId, provider.providerId))
-      .limit(1);
+    const existing = await getSSOProviderByProviderId(dbClient)(provider.providerId);
 
-    if (existing.length > 0) {
+    if (existing) {
       return;
     }
 
     if (!provider.domain) {
       throw new Error(`SSO provider '${provider.providerId}' must have a domain`);
     }
 
-    await dbClient.insert(authSchema.ssoProvider).values({
+    await createSSOProvider(dbClient)({
       id: generateId(),
       providerId: provider.providerId,
       issuer: provider.issuer,
       domain: provider.domain,
       oidcConfig: provider.oidcConfig ? JSON.stringify(provider.oidcConfig) : null,
       samlConfig: provider.samlConfig ? JSON.stringify(provider.samlConfig) : null,
-      userId: null,
       organizationId: provider.organizationId || null,
     });
   } catch (error) {
@@ -217,11 +196,11 @@ export function createAuth(config: BetterAuthConfig) {
       session: {
         create: {
           before: async (session) => {
-            const organization = await getInitialOrganization(config.dbClient, session.userId);
+            const membership = await getInitialOrganizationForUser(config.dbClient)(session.userId);
             return {
               data: {
                 ...session,
-                activeOrganizationId: organization?.id ?? null,
+                activeOrganizationId: membership?.organizationId ?? null,
               },
             };
           },

packages/agents-core/src/data-access/index.ts

@@ -26,9 +26,9 @@ export * from './manage/subAgents';
 export * from './manage/subAgentTeamAgentRelations';
 export * from './manage/tools';
 export * from './manage/triggers';
-
-// Runtime data access (Postgres - not versioned)
 export * from './runtime/apiKeys';
+// Runtime data access (Postgres - not versioned)
+export * from './runtime/auth';
 export * from './runtime/cascade-delete';
 export * from './runtime/contextCache';
 export * from './runtime/conversations';

packages/agents-core/src/data-access/runtime/auth.ts

@@ -0,0 +1,51 @@
+import { eq } from 'drizzle-orm';
+import { member, ssoProvider } from '../../auth/auth-schema';
+import type { AgentsRunDatabaseClient } from '../../db/runtime/runtime-client';
+
+export const getInitialOrganizationForUser =
+  (db: AgentsRunDatabaseClient) =>
+  async (userId: string): Promise<{ organizationId: string } | null> => {
+    const [result] = await db
+      .select({ organizationId: member.organizationId })
+      .from(member)
+      .where(eq(member.userId, userId))
+      .orderBy(member.createdAt)
+      .limit(1);
+
+    return result ?? null;
+  };
+
+export const getSSOProviderByProviderId =
+  (db: AgentsRunDatabaseClient) =>
+  async (providerId: string): Promise<{ id: string } | null> => {
+    const [result] = await db
+      .select({ id: ssoProvider.id })
+      .from(ssoProvider)
+      .where(eq(ssoProvider.providerId, providerId))
+      .limit(1);
+
+    return result ?? null;
+  };
+
+export const createSSOProvider =
+  (db: AgentsRunDatabaseClient) =>
+  async (data: {
+    id: string;
+    providerId: string;
+    issuer: string;
+    domain: string;
+    oidcConfig?: string | null;
+    samlConfig?: string | null;
+    organizationId?: string | null;
+  }): Promise<void> => {
+    await db.insert(ssoProvider).values({
+      id: data.id,
+      providerId: data.providerId,
+      issuer: data.issuer,
+      domain: data.domain,
+      oidcConfig: data.oidcConfig ?? null,
+      samlConfig: data.samlConfig ?? null,
+      userId: null,
+      organizationId: data.organizationId ?? null,
+    });
+  };

scripts/lint-data-access-boundary.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Enforces that drizzle-orm imports only appear in allowed directories.
+# Designed to run via lint-staged on staged files only.
+#
+# Usage: scripts/lint-data-access-boundary.sh file1.ts file2.ts ...
+
+set -euo pipefail
+
+VIOLATIONS=()
+
+for file in "$@"; do
+  # Skip allowed directories
+  case "$file" in
+    */data-access/* | */db/* | */dolt/* | */__tests__/* | *.test.ts | *.spec.ts | */test-*)
+      continue
+      ;;
+  esac
+
+  # Check for drizzle-orm imports
+  if grep -qE "from ['\"]drizzle-orm" "$file" 2>/dev/null; then
+    VIOLATIONS+=("$file")
+  fi
+done
+
+if [ ${#VIOLATIONS[@]} -gt 0 ]; then
+  echo ""
+  echo "ERROR: drizzle-orm imports found outside the data-access layer:"
+  echo ""
+  for v in "${VIOLATIONS[@]}"; do
+    echo "  $v"
+  done
+  echo ""
+  echo "Move database queries to packages/agents-core/src/data-access/ and import"
+  echo "the data-access functions instead. See CLAUDE.md for architecture guidelines."
+  echo ""
+  exit 1
+fi