fix(session-policy): unify join paths on applySessionPolicyToNewMember; final audit polish (dead exports, response bound, test name)

Author: waleedlatif1

apps/sim/ee/session-policy/components/session-policy-settings.tsx

@@ -213,5 +213,3 @@ export function SessionPolicySettings({ organizationId }: SessionPolicySettingsP
     </>
   )
 }
-
-export default SessionPolicySettings

apps/sim/lib/api/contracts/organization.ts

@@ -197,14 +197,10 @@ export const organizationSessionPolicyResponseSchema = z.object({
 export const revokeOrganizationSessionsResponseSchema = z.object({
   success: z.boolean(),
   data: z.object({
-    revokedSessions: z.number().int(),
+    revokedSessions: z.number().int().min(0),
   }),
 })
 
-export type RevokeOrganizationSessionsResult = z.output<
-  typeof revokeOrganizationSessionsResponseSchema
->['data']
-
 export const updateOrganizationWhitelabelBodySchema = z.object({
   brandName: z
     .string()

apps/sim/lib/auth/session-policy.test.ts

@@ -47,7 +47,7 @@ describe('clampSessionExpiry', () => {
     expect(result.getTime()).toBe(now.getTime() + 48 * HOUR_MS)
   })
 
-  it('floors idleTimeoutHours at the cookie-cache window', () => {
+  it('floors idleTimeoutHours at twice the cookie-cache window', () => {
     const result = clampSessionExpiry(policy({ idleTimeoutHours: 1 }), createdAt, proposed, now)
     expect(result.getTime()).toBe(now.getTime() + MIN_IDLE_TIMEOUT_HOURS * HOUR_MS)
   })

apps/sim/lib/billing/organizations/membership.ts

@@ -25,6 +25,7 @@ import { generateId } from '@sim/utils/id'
 import { normalizeEmail } from '@sim/utils/string'
 import { and, count, eq, inArray, isNull, ne, or, sql } from 'drizzle-orm'
 import { invalidateMembershipCache } from '@/lib/auth/security-policy'
+import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import {
   assertNoUnresolvedEnterpriseIssuance,
@@ -632,7 +633,9 @@ export async function ensureUserInOrganization(
   const result = await addUserToOrganization(params)
 
   if (result.success) {
-    invalidateMembershipCache(params.userId)
+    // Invalidates the membership cache and clamps pre-join sessions to the
+    // org policy — same treatment as invite acceptance. Best-effort.
+    await applySessionPolicyToNewMember(params.userId, params.organizationId)
   }
 
   return {
@@ -1518,9 +1521,10 @@ export async function transferUserBetweenOrganizations(
         }
       }
     )
-    // The transferred member's cookie-version/hook-clamp fallbacks must
-    // resolve to the destination org immediately, not after the cache TTL.
-    invalidateMembershipCache(params.userId)
+    // The transferred member's fallbacks must resolve to the destination org
+    // immediately, and their sessions clamp to its policy — same treatment as
+    // invite acceptance. Best-effort.
+    await applySessionPolicyToNewMember(params.userId, params.destinationOrganizationId)
     return transferResult
   } catch (error) {
     logger.error('Failed to transfer organization member', { ...params, error })