From 7d8ed9bfba1eeb531e407ccd046f4f13134af50e Mon Sep 17 00:00:00 2001
From: sax3l <simon@siax.io>
Date: Mon, 2 Nov 2026 16:07:22 +0100
Subject: [PATCH] fix(auth): request the resourceowner scope so the tenant
 claim is present

Zitadel omits urn:zitadel:iam:org:id from the id_token for the default scopes.
Requesting urn:zitadel:iam:user:resourceowner yields the user's org id, which
deriveTenantId already understands. Also log claim keys (never values) when the
tenant is still absent.
---
 lib/oidc.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/oidc.ts b/lib/oidc.ts
index ff8338d..177c837 100644
--- a/lib/oidc.ts
+++ b/lib/oidc.ts
@@ -60,7 +60,7 @@ export function authorizeUrl(config: OidcConfig, state: string, nonce: string, c
     client_id: config.clientId,
     redirect_uri: config.redirectUri,
     response_type: 'code',
-    scope: 'openid profile email',
+    scope: 'openid profile email urn:zitadel:iam:user:resourceowner',
     state,
     nonce,
     code_challenge: challenge,
-- 
2.54.0