feat(profile): Handle company field

Author: x42en

CONTRIBUTING.md

@@ -9,6 +9,7 @@ Thank you for your interest in contributing to ioserver-oidc! This document cove
 - [Architecture rules](#architecture-rules)
   - [Component model](#component-model)
   - [TypeScript requirements](#typescript-requirements)
+  - [Development standards](#development-standards)
   - [Naming conventions](#naming-conventions)
 - [Test suite](#test-suite)
   - [Running tests](#running-tests)
@@ -75,6 +76,17 @@ Rules:
 - The `OidcConfig` interface is the single source of truth for configuration shape — add new options there first, then propagate to `buildConfig()` and the middlewares
 - Tests use `tsconfig.test.json` which extends the base config with looser `module`/`moduleResolution` settings to support top-level `await` in test files
 
+### Development standards
+
+- **Language**: All code (source, comments, documentation, interfaces, variable/function names) must be written in **English**. No exceptions.
+- **Single responsibility**: Each class must have one clear responsibility. Prefer multiple small focused classes over a single large one.
+- **File size**:
+  - Target: **≤ 500 lines** per file
+  - Allowed exception: up to **1 000 lines** for complex business logic where further splitting would harm readability
+  - Documentation files (`.md`) have no hard limit but should remain concise
+- **No implicit `any`**: Enforced by `strict` + `noImplicitAny`. Every exported symbol must be fully typed; use `unknown` with type-guards at boundaries.
+- **PR hygiene**: Zero TypeScript errors and zero ESLint warnings before opening a pull request.
+
 ### Naming conventions
 
 | Element | Convention |

src/OidcHttpMiddleware.ts

@@ -117,6 +117,9 @@ export class OidcHttpMiddleware extends BaseMiddleware {
       (request as Record<string, unknown>)["roles"] = oidcCtx.roles;
       (request as Record<string, unknown>)["permissions"] = oidcCtx.permissions;
       (request as Record<string, unknown>)["features"] = oidcCtx.features;
+      if (oidcCtx.org_id !== undefined) {
+        (request as Record<string, unknown>)["org_id"] = oidcCtx.org_id;
+      }
     };
   }
 

src/OidcSocketMiddleware.ts

@@ -108,6 +108,9 @@ export class OidcSocketMiddleware extends BaseMiddleware {
       socket.roles = oidcCtx.roles;
       socket.permissions = oidcCtx.permissions;
       socket.features = oidcCtx.features;
+      if (oidcCtx.org_id !== undefined) {
+        socket.org_id = oidcCtx.org_id;
+      }
 
       // ── 6. Register with session manager (if available) ──────────────
       if (typeof appHandle["session"]?.registerSocket === "function") {

src/jwks.ts

@@ -91,7 +91,9 @@ export async function verifyOidcToken(
   // Primary role: first element of the roles array, fallback "user"
   const userRole = roles[0] ?? "user";
 
-  return {
+  const org_id = typeof p["org_id"] === "string" ? p["org_id"] : undefined;
+
+  const ctx: OidcUserContext = {
     userId: sub, // will be replaced by DB id after findOrCreate in middleware
     sub,
     email: typeof p["email"] === "string" ? p["email"] : null,
@@ -101,4 +103,6 @@ export async function verifyOidcToken(
     permissions,
     features,
   };
+  if (org_id !== undefined) ctx.org_id = org_id;
+  return ctx;
 }

src/types.ts

@@ -111,4 +111,10 @@ export interface OidcUserContext {
    * user has no active subscription.
    */
   features: OidcFeatures;
+
+  /**
+   * Active organization ID from the `org_id` JWT claim.
+   * Present when the `org` scope was requested and the user has an active organization.
+   */
+  org_id?: string;
 }