- Shipped
- 27 Agosti 2026, 01:14 UTC
- Author
- kamo
- Commit
- 05ff51b
Choose "ABC Mortgage" at sign-in and you arrived in a workspace wearing KamoCRM's logo and colours, with a left-hand menu offering White Labeling, Plans & Billing and Stats & Costs — platform surfaces nobody in ABC Mortgage has. The session was correct throughout: SecurityService minted it against ABC Mortgage and logged `[ORG-SELECT] entered orgId=1170945408993296390`. Only the SHELL was wrong, and it stayed wrong for the life of the tab. The shell takes its tenant from `?org=` on the URL, the only per-tab thing a document request carries. Three faults, each enough on its own: 1. `?org=` was never written. /api/validate resolves the organization for the session and returns it; the page read that off a THREE-FIELD COPY of the response made two lines earlier, which had never carried it. Undefined on every sign-in since the day it was introduced, so nothing was ever named. 2. The value being passed was the org's resolved DOMAIN. An organization with no host of its own is given the invented name `<alias>.kamocrm.com`, and a reference with a dot is looked up as a HOSTNAME — where the by-host lookup drops the deepest label once when nothing matches. `abc-mortgage.kamocrm.com` resolves to `kamocrm.com`: KamoCRM Inc. Worse than sending nothing, because the lookup SUCCEEDS and the platform is then marked as the tab's trusted, named tenant. The alias goes out instead, which can only ever name the org that owns it. 3. Neither of those could be recovered from. The alias lookup is session-guarded, and the first document after a sign-in carries no *** cookie — the session is in this tab's sessionStorage, which a document request cannot see. So the render falls back to the HOST, which on internal.kamocrm.com answers "the platform". That answer is deliberately untrusted, so nothing recorded it and nothing wrote `?org=`, which left the next render with nothing to resolve either. So the tab now asks the one thing that knows: its own session. The per-tab token rides every /api/* call, /api/org/current answers with the organization that session is in, and the shell adopts it — branding, features, and the isTopLevel flag the platform-admin menu is gated on. That route existed for exactly this and had been orphaned since the shell stopped reading the cookie; it gated on the cookie's presence, which is why it would have refused the very call that needs it. The URL is only rewritten when it was naming nothing usable. `?org=` carries a second meaning on /network — the id of the organization whose drawer is open, which a support conversation links straight at — and a render that resolved its reference already has a working one.