Phil’s role @ Hgraph.com

GoTrue offers no hook to reject a social login by email domain, so a user at a captured domain can click “Continue with Google” and succeed. Rather than unreliably preventing that account, I let it exist as a zero-access shell and moved enforcement to the authorization layer. api.session_can_access_org() reads the SAML provider out of the session token’s amr claim and is ANDed intoapi.is_org_member and api.is_org_admin. Assume the application layer is buggy, and put the boundary underneath it.

Three BEFORE triggers stop an SSO account from owning an org outside its mapping, from joining another org through any write path including service-role inserts, and from being invited elsewhere. No application bug can route around them. Defence in depth: row-level security, a resolver gate across 24 org-addressed resolvers, and the triggers.

api.migrate_sso_user() is a SECURITY DEFINER function that runs the whole migration in one transaction: it verifies the domain is genuinely captured by that user’s provider, re-points 19 user-linked tables — memberships, keys, credentials, projects, saved editor state, ownership columns — resolves role collisions by rank, bans the old account by writing banned_until directly, and deletes its sessions and refresh tokens. Idempotent under concurrency, execute revoked from anon and authenticated, with an integration test asserting it cannot be invoked through the REST layer.

Every check keys on the organization’s sso_enforced flag or on thesso: identity prefix, so organizations without SSO and personal accounts are provably unaffected. The migration also revokes the table-level grant onapi.organization and re-grants an explicit column list, because a permissive read policy would otherwise have exposed SSO configuration through the auto-generated REST API.

POST /agent/chat emits a typed Server-Sent-Events contract of eleven named events — org, thread, attachment, usage, status, tool start, tool result, text delta, stats, complete, error — with per-token deltas from the Anthropic streaming SDK. A single finalize() behind a guard flag runs on every exit path, so a client that closes the tab mid-answer still persists what completed rather than losing the turn.

The thread store uses column-level grants rather than blanket table grants: an authenticated client may insert only five columns and update only two. Share slugs, publish state and soft deletes are unwritable from the client by construction, not by validation. Four row-level-security policies scope reads. The schema carries a surfacecolumn on purpose, so a future in-dashboard assistant writes into the same history instead of needing a migration.

Spend control prices real input, output, cache-read and cache-write tokens into a per-seat daily allowance for the expensive reasoning mode and a per-org monthly USD ceiling, held on durable Valkey counters with alert webhooks at 80% and 100%. The counter path runs as a dedicated cache user restricted to two key prefixes and a ten-command allowlist, so the agent’s spend accounting cannot read or write anything else in a shared cache.

The model emits a validated chart specification in a fenced block, which promotes to a line, area or bar chart on a shared axis and tooltip base. An unclosed fence mid-stream shows a “preparing chart” placeholder rather than raw JSON; an invalid specification falls back to visible markdown so nothing is ever silently lost. Answers also carry the exact query that produced them, copyable and deep-linked into the GraphQL playground.

Streaming state is a reducer over segments and pending tool slots rather than scatteredsetState calls, which makes event ordering, tool-slot correlation and delta coalescing unit-testable instead of hopeful. Every callback is guarded on an abort signal and aborts on unmount.