Summary

Two related admin-view scoping bugs, both about a caller-named userId/targetUserId losing its authorization check or getting dropped in transit:

• chat.ts (IDOR , was unauthenticated cross-user read/write): getThreads, getMessages, listThreadsForAgent, listThreadsForConversation, and createThread accepted a client-supplied userId/targetUserId with no authorization check at all. Any authenticated caller could read (or, via createThread, forge) another user's chat threads and messages by naming their id , admin or not, same org or not. Every cross-user read now goes through authorize() via a new chat_thread:user policy row (SELF_OR_ORG_ADMIN), the same authority agent.* and documents.getDoc already use; createThread now refuses any foreign userId outright (read-only admin delegation, no admin write path). During review I deduplicated the four near-identical inline authorization blocks onto the existing assertActor helper, which already implements the exact self-path-short-circuit-then-authorize shape.
• Brain playbook document nav (admin scope silently dropped): an org admin clicking an @resources/... reference or a subagent chip inside a teammate's open playbook document lost the admin's targetUserId on navigation , brainDocumentPath(doc.id) was called without it, even though the query that had just fetched that doc already carried it. The Knowledge explorer then re-fetched by bare documentId with no scope and hit the per-user ownership check as the admin instead of the teammate, so the admin got a permission failure browsing a teammate's own AOP resources/subagents , the exact bug reported. Fixed by threading targetUserId/ownerUserId through all four affected navigate(brainDocumentPath(...)) call sites, matching the pattern the tree view (PlaybookAopSection) already used correctly. Exhaustively verified every other brainDocumentPath call site in apps/mail; the two that remain unscoped (useOpenContextArtifact, BrainHero's recent-files rail) are legitimately self-only.

Test plan

• pnpm --filter @zero/server run types , clean
• pnpm --filter @zero/mail run types , clean
• pnpm --filter @zero/server exec vitest run src/trpc/routes/__tests__/chat-router-org-admin.test.ts , 12/12 pass (admin can read a teammate's threads/messages; a plain member and an out-of-org admin are refused; the ordinary self path is untouched)
• pnpm --filter @zero/server exec vitest run src/trpc/routes/__tests__/chat-agent-binding.test.ts , 10/10 pass (unaffected sibling suite)
• pnpm --filter @zero/server exec eslint src/trpc/routes/chat.ts , clean

🤖 Generated with Claude Code

https://claude.ai/code/session_0187itFj1uakga2xd7kPk4qp

Greptile Summary

This PR closes caller-supplied chat-thread ownership gaps and preserves administered-user scope when navigating from playbooks into related documents.

• Adds a chat_thread:user authorization policy and routes cross-user chat reads through the shared effective-actor authority.
• Rejects creation of chat threads attributed to another user.
• Carries teammate scope through playbook resource and subagent document navigation.
• Adds authorization-focused tests, although their database mock does not verify effective-user query scoping and the test contains casts prohibited by repository guidance.

Confidence Score: 4/5

The behavioral changes appear sound, but the repository's explicit no-casts requirement must be satisfied before merging; strengthening the security regression test's query-scope assertions is also recommended.

The authorization and navigation implementations preserve the intended effective user and fail closed across organizations. The remaining findings concern a security-focused mock that cannot detect ownership-predicate regressions and prohibited TypeScript assertions in the new test.

**F