Add organizationContext for multi-tenant applications

[Copilot]

Multi-tenant applications need organization-scoped functions where auth extracts organization identity and injects it into resolvers, parallel to the existing userContext() pattern.

Implementation

Core API

• Added organizationContext() helper with symbol-based metadata tracking
• Extended AuthResult type with optional organization field
• Organization context fields stripped from public API/MCP schemas, injected at runtime
• Startup validation ensures auth returns organization when functions require it

Runtime Integration

• Lockfile tracks usesOrganizationContext in function shapes for change detection
• MCP tools executor injects organization from auth result
• API router merges organization into function arguments before validation

Browser UI

• "Org Context" filter button with count badge (styled with magenta/building icon)
• Function detail panels show organization context badge
• Mock organization context available in test mode

Documentation

• New /docs/src/content/docs/api/organization-context.md with multi-tenant patterns
• Claude skills template updated with organization examples
• Auth patterns for query params, headers, subdomains

Usage

import { defineOntology, organizationContext, z } from 'ont-run';

export default defineOntology({
  auth: async (req) => {
    const orgId = new URL(req.url).searchParams.get('org_id');
    const org = await db.organizations.findById(orgId);
    await verifyMembership(user.id, org.id);
    
    return {
      groups: ['member'],
      organization: { id: org.id, name: org.name },
    };
  },
  
  functions: {
    createProject: {
      description: 'Create a project in the organization',
      access: ['member'],
      entities: ['Project'],
      inputs: z.object({
        name: z.string(),
        // Organization context injected from auth, hidden from callers
        currentOrg: organizationContext(z.object({
          id: z.string(),
          name: z.string(),
        })),
      }),
      resolver: async (ctx, args) => {
        return db.projects.create({
          name: args.name,
          organizationId: args.currentOrg.id, // Auto-injected
        });
      },
    },
  },
});

Can be used alone or combined with userContext() for functions requiring both identities.

Review UI Validation

Overview with both context filters:

Filter buttons highlighted:

UI correctly displays:

• "Org Context (3)" button showing 3 functions using organization context
• "User Context (2)" button showing 2 functions using user context
• Distinct styling (cyan/building icon vs teal/user icon)
• Proper tracking in lockfile changes

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.