fix(nextjs): call the /o APIs for organization sessions on the server

[DonOmalVindula]

Problem

For a session that belongs to an organization (a B2B sign-in or an organization switch, i.e. the ID token carries a user_org claim), the SCIM2 and organization APIs must be called under /o. The React SDK does this in updateSession() (${baseUrl}/o when user_org is present).

In the Next.js SDK, AsgardeoServerProvider computes the same /o base URL, but only passes it to the client-side context. Every server action goes through AsgardeoNextClient, whose getUser, getUserProfile, updateUserProfile, createOrganization and getOrganization read the root baseUrl from the client configuration. So for organization sessions the SCIM2 Me/Schemas calls, profile updates, and organization creation/lookup hit the root endpoints with an organization-scoped token: the profile silently falls back to the ID token claims (editing disabled) and the organization operations fail.

Fix

• AsgardeoNextClient.resolveBaseUrl() returns ${baseUrl}/o when the session cookie carries an organizationId (set from the user_org claim at sign-in / switch / refresh), otherwise the configured base URL. It does not append /o twice when the configured base URL already targets an organization.
• The five methods above use it. getMyOrganizations / getAllOrganizations keep the root base URL, which is what the React SDK's client does for those two calls.

Testing

• New unit tests assert the base URL passed to getScim2Me, getSchemas, updateMeProfile, createOrganization and getOrganization for root sessions, organization sessions, an already /o base URL, and no session cookie (66 tests pass).
• pnpm lint and tsc --noEmit for @asgardeo/nextjs.
• Not exercised against a live identity server in this PR.

Changeset included (@asgardeo/nextjs patch).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 2f80cd13-91e5-432d-8c13-7a3a776957c1

📥 Commits

Reviewing files that changed from the base of the PR and between 409ebae and ed8f7cc.

📒 Files selected for processing (3)

• .changeset/nextjs-organization-base-url.md
• packages/nextjs/src/AsgardeoNextClient.ts
• packages/nextjs/src/__tests__/AsgardeoNextClient.baseUrl.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[asgardeo-github-bot]

🦋 Changeset detected

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.