[WendellAdriel]

The /dev/null TUI can now post as an organization, but GET /api/v1/me doesn't say which organizations you're a member of or whether posting as one is switched on. Without that, the TUI asks for a typed handle and opens the organization's page to check membership. This adds organizations, ordered by oldest membership like the web's Post as menu and including your role in each, and can_post_as_organization, which follows the OrganizationCommits feature. With both, a client can offer the same choices as the web.

Summary by CodeRabbit

• New Features

  • Current-user API responses now include organization memberships, each organization’s role, and whether posting as an organization is enabled.
  • Memberships are listed from oldest to newest.

• Documentation

  • Updated the signed API documentation to describe the organization membership and posting-availability fields.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The signed current-user response now includes the user’s organization memberships, roles, and organization-posting capability. Memberships are ordered by creation time and organization ID. The profile response excludes these fields, and the signed API capability documentation describes them.

Changes: Current-user organization data

Layer / File(s)	Summary
Add organization data to the current-user response app/Http/Resources/CurrentUserResource.php, tests/Feature/Controllers/Api/CurrentUserControllerTest.php, KNOWLEDGE_BASE.md	The resource returns organization memberships with roles and organization details, ordered by membership creation time and organization ID. It reports whether organization commits are enabled. Tests cover membership ordering, feature-disabled behavior, empty membership data, and profile responses. The signed API capability documentation describes the new response data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Possibly related issues

• [RFC] Orgs #938: This PR exposes the organization memberships, roles, and posting capability described by the issue.
• Better organisation account control #1394: This PR exposes membership and role state in the current-user API, but does not implement membership revocation or synchronization.

Possibly related PRs

• dev-null-sh/dev-null.sh#1316: This PR uses the Organization model and membership relation with pivot roles introduced there.
• dev-null-sh/dev-null.sh#1458: This PR exposes equivalent organization membership and posting capability data through the signed current-user API.

Suggested reviewers: mnapoli, kachelle, simonhamp

Merge Risk: Minimal · previous review 152b8

The new fields expose memberships and posting availability. No merge-blocking risk was identified.

Security architecture risk: Low · up to 152b8

This is a bounded expansion of authenticated account data, not a new permission grant. Membership filtering and server-side posting checks remain in place. No introduced security weakness was identified in the reviewed paths.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The additional disclosure consists of the current user's organization associations and roles, alongside established organization profile fields. The membership query does not enumerate unrelated organizations or other users' memberships.

Trust Boundaries and Controls

• observed — Signed-device authentication binds the read response to the device owner. Separately, posting validation checks feature state and membership before passing a resolved Organization to CreateCommit. The new response fields therefore do not themselves grant organization-author authority.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: adding organization listings and the ability to post as an organization to the current-user API response. The wording is slightly awkward, but it remains s…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title clearly describes the main change: adding organization listings and the ability to post as an organization to the current-user API response. The wording is slightly awkward, but it remains specific and relevant.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ca991680-0acd-4dc2-91a7-8a5c42d2f562

Commits

Reviewing files that changed from the base of the PR and between facb804 and 152b8b8.

Files selected for processing: 3

• KNOWLEDGE_BASE.md
• app/Http/Resources/CurrentUserResource.php
• tests/Feature/Controllers/Api/CurrentUserControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[WendellAdriel]

Just pinging you on this @nunomaduro (sorry to bother, but this will improve the UX on the TUI xD) 🫶