Add GET /api/organizations/surface

An authorized read of the viewer's own organization, resolved from membership:
the existing surface context plus navigation flags, the legacy layout's runtime
flags, and the settings sections the legacy sidebar rule allows, so the Platform
never re-derives those gates.

Author: waleedlatif1

apps/sim/app/api/organizations/surface/route.ts

@@ -0,0 +1,22 @@
+import { getOrganizationSurfaceContract } from '@/lib/api/contracts/organization'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalOrganizationErrorPolicy } from '@/lib/api/server/routes/organizations'
+import { organizationOperations } from '@/lib/organizations/application/operations'
+import { readOrganizationSurface } from '@/lib/organizations/application/surface'
+
+export const GET = defineInternalJsonRoute({
+  contract: getOrganizationSurfaceContract,
+  auth: internalSessionAuth,
+  operation: organizationOperations.readSurface,
+  rateLimit: internalRateLimits.none({
+    reason:
+      'Read once per Platform document, as the legacy organization layout reads it per render',
+  }),
+  errorPolicy: internalOrganizationErrorPolicy,
+  mapInput: () => ({}),
+  useCase: readOrganizationSurface,
+})

apps/sim/lib/api/contracts/organization.ts

@@ -8,6 +8,7 @@ import {
 } from '@/lib/api/contracts/primitives'
 import { organizationBillingDataSchema } from '@/lib/api/contracts/subscription'
 import { defineRouteContract } from '@/lib/api/contracts/types'
+import { deploymentShapeSchema } from '@/lib/api/contracts/workspaces'
 import { memberCreditLimitUpdateSchema } from '@/lib/billing/application/usage-limit-validation'
 import { HEX_COLOR_REGEX } from '@/lib/branding'
 import {
@@ -522,6 +523,66 @@ export const getOrganizationContract = defineRouteContract({
   response: { mode: 'json', schema: getOrganizationResponseSchema },
 })
 
+const organizationSurfaceResponseSchema = z.object({
+  organization: z.object({
+    id: z.string().min(1),
+    name: z.string(),
+    slug: z.string(),
+    logo: z.string().nullable(),
+    memberCount: z.number().int().nonnegative(),
+  }),
+  viewer: z.object({
+    role: organizationRoleSchema,
+    isAdmin: z.boolean(),
+    canInviteMembers: z.boolean(),
+    canConnectSearchIntegrations: z.boolean(),
+    canUsePersonalApiKeys: z.boolean(),
+    canUseSearchMcp: z.boolean(),
+  }),
+  mothershipAvailable: z.boolean(),
+  canBuild: z.boolean(),
+  searchAccess: z.object({
+    sourceMirrored: z.boolean(),
+    memberScoped: z.boolean(),
+  }),
+  connectedAccountsAvailable: z.boolean(),
+  settingsFeatures: z.object({
+    billingEnabled: z.boolean(),
+    hasEnterprisePlan: z.boolean(),
+    governanceActive: z.boolean(),
+    hosted: z.boolean(),
+    selfHosted: z.record(z.string(), z.boolean().optional()),
+  }),
+  deployment: deploymentShapeSchema,
+  /** Which destinations the viewer's navigation lists; none of these authorizes the page behind it. */
+  navFlags: z.object({
+    people: z.boolean(),
+    simLinks: z.boolean(),
+    benchmark: z.boolean(),
+    platformAdmin: z.boolean(),
+    anonymous: z.boolean(),
+  }),
+  featureFlags: z.object({
+    dashboards: z.boolean(),
+    'workflow-tests': z.boolean(),
+    changelog: z.boolean(),
+    'mothership-model-selector': z.boolean(),
+    'mothership-computer-use': z.boolean(),
+    'mothership-plan-mode': z.boolean(),
+    'mothership-memory-spaces': z.boolean(),
+    projects: z.boolean(),
+  }),
+  /** Settings sections the viewer may reach, from the same rule the legacy settings sidebar uses. */
+  settingsSections: z.array(z.string().min(1)),
+})
+export type OrganizationSurfaceResponse = z.output<typeof organizationSurfaceResponseSchema>
+/** The viewer's own organization is resolved from their membership, so the route names none. */
+export const getOrganizationSurfaceContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/organizations/surface',
+  response: { mode: 'json', schema: organizationSurfaceResponseSchema },
+})
+
 export const updateOrganizationContract = defineRouteContract({
   method: 'PUT',
   path: '/api/organizations/[id]',

apps/sim/lib/organizations/application/operations.ts

@@ -21,6 +21,15 @@ export const organizationOperations = {
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token'],
     oauthScope: 'api:read',
   }),
+  /**
+   * permission-group-exempt: this is a member's own view of their organization; each capability it reports is resolved from the same permission config rather than gating the read.
+   */
+  readSurface: defineOrganizationOperation({
+    id: 'organizations.surface.read',
+    minimumRole: 'member',
+    capability: 'none',
+    principalKinds: ['session'],
+  }),
   /**
    * permission-group-exempt: administrators must be able to discover workspaces they govern.
    */

apps/sim/lib/organizations/application/surface.ts

@@ -0,0 +1,93 @@
+import { ANONYMOUS_USER_ID } from '@sim/auth/principal'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import type { OrganizationSurfaceResponse } from '@/lib/api/contracts/organization'
+import type { OperationUseCase } from '@/lib/core/application/operation'
+import {
+  authorizeOrganizationOperation,
+  OrganizationMembershipNotFoundError,
+} from '@/lib/core/application/organization-authorization'
+import { PrincipalKindAuthorizationError } from '@/lib/core/application/workspace-authorization'
+import { organizationOperations } from '@/lib/organizations/application/operations'
+import {
+  getOrganizationSurfaceContext,
+  resolveOrganizationLanding,
+} from '@/lib/organizations/surface'
+import { resolveOrganizationSurfaceFlags } from '@/lib/organizations/surface-flags'
+import { canBrowsePeople } from '@/lib/people/feature-flag'
+import { isPlatformAdmin } from '@/lib/permissions/super-user'
+import { isSimLinksEnabled } from '@/lib/sim-links/feature-flag'
+import { organizationSurfaceSettingsNavigation } from '@/app/o/[organizationId]/settings/navigation'
+
+const logger = createLogger('OrganizationSurfaceRead')
+
+/**
+ * The viewer's organization surface, resolved from their membership. A member belongs to one
+ * organization, so the caller names none and session active-organization state is not consulted.
+ * Having no membership reads the same as not being a member of a named organization.
+ */
+export const readOrganizationSurface: OperationUseCase<
+  typeof organizationOperations.readSurface,
+  Record<string, never>,
+  OrganizationSurfaceResponse
+> = {
+  operation: organizationOperations.readSurface,
+  async execute({ principal }) {
+    if (principal.kind !== 'session') {
+      throw new PrincipalKindAuthorizationError(
+        principal.kind,
+        organizationOperations.readSurface.id
+      )
+    }
+    const { userId } = principal
+    const organizationId = await resolveOrganizationLanding(userId, null)
+    if (!organizationId) throw new OrganizationMembershipNotFoundError()
+    await authorizeOrganizationOperation(principal, organizationOperations.readSurface, {
+      organizationId,
+    })
+    const context = await getOrganizationSurfaceContext(organizationId, userId)
+    if (!context) throw new OrganizationMembershipNotFoundError()
+
+    const [{ flags, benchmarkEnabled }, people, simLinks, platformAdmin] = await Promise.all([
+      resolveOrganizationSurfaceFlags(organizationId, userId),
+      canBrowsePeople(organizationId, context.viewer.role),
+      isSimLinksEnabled(organizationId),
+      /** Decides which links are drawn; the pages behind them authorize for themselves. */
+      isPlatformAdmin(userId).catch((error: unknown) => {
+        logger.warn('Could not resolve platform administration navigation', {
+          error: getErrorMessage(error),
+        })
+        return false
+      }),
+    ])
+
+    return {
+      organization: context.organization,
+      viewer: context.viewer,
+      mothershipAvailable: context.mothershipAvailable,
+      canBuild: context.canBuild,
+      searchAccess: context.searchAccess,
+      connectedAccountsAvailable: context.connectedAccountsAvailable,
+      settingsFeatures: context.settingsFeatures,
+      deployment: context.deployment,
+      navFlags: {
+        people,
+        simLinks,
+        benchmark: benchmarkEnabled,
+        platformAdmin,
+        anonymous: userId === ANONYMOUS_USER_ID,
+      },
+      featureFlags: flags,
+      settingsSections: organizationSurfaceSettingsNavigation(
+        context.viewer.isAdmin,
+        context.settingsFeatures,
+        {
+          connectedAccounts: context.connectedAccountsAvailable,
+          search: context.searchAccess.memberScoped,
+          knowledgeGraphs: flags['mothership-memory-spaces'],
+        },
+        platformAdmin
+      ).map((item) => item.id),
+    }
+  },
+}