[rohitsasi720]

Summary

Since #1262, the API marks each mention as a user or an organization, but organization pages exist only on the web. When someone taps an organization mention in the mobile app, the app has nothing to fetch. Before the app read the mention's kind, a tap on @laravel opened a profile and failed with "No query results for model [App\Models\User] laravel".

This adds GET /api/v1/organizations/{handle}, so the app can show an organization's page natively. Like users/{handle}, it is public and also works for signed requests. It returns what the web's organization page shows.

Changes

• New route: GET /api/v1/organizations/{handle} (api-organization.show), in the same throttle:api and optional-signature group as users/{handle}.
• Api\OrganizationController@show returns {"data": {handle, name, avatar_url, bio, location, website}}. These are the Profile model's visible fields, the same ones the web page gets. id, github_id, type and the timestamps stay hidden.
• ShowApiOrganizationRequest finds the organization profile by handle and returns 404 for anything else, including a handle a user has.
  • The match ignores case, because a mention keeps the case it was written in: @Laravel asks for Laravel. It uses LOWER(handle) = ? like UpdateStaleHandles, which profiles_lower_handle_index covers.
  • The web's /@{handle} lookup is unchanged and still matches case exactly.
• KNOWLEDGE_BASE.md lists the endpoint with the public read API and links it from the Organization pages section. PRODUCT.md already covers organization pages and the app's API, so it is unchanged.

Validation

All checks ran locally, not in hosted CI.

• php -d memory_limit=-1 vendor/bin/pest --parallel --ci: 4779/4779 passed, at the first revision. After the review fixes, the organization and arch tests were rerun: 15/15 passed.
• composer test:lint exits 0. Its only warnings were already there.
• composer test:type-coverage: 100.0%.
• PHPStan: 0 errors on the changed files.
• Not run locally: the coverage run with --coverage --exactly=100.0, because this machine has no coverage driver. The new tests exercise every new line, and CI will confirm the exact figure.
• bun run test:unit was not run, because no frontend code changed.
• Device: not applicable, since nothing changes in the web UI. The app side of this was exercised on a Pixel 9 (Android) against production. Org mentions open the app's new organization screen, which falls back to the web page until this endpoint is deployed.

Independent review

An independent reviewer agent, separate from the implementer, did a read-only review.

• Base: 3a6eabe2 (production)
• First review, head 79c2ac14: CODE: PASS. It asked for the knowledge base update and flagged the case-sensitive lookup.
• Fixed in 431e176d: the knowledge base entry, the case-insensitive match plus a test, and a PHPDoc line.
• Re-review, head 431e176d: CODE: PASS, no findings.
• Visual review: not applicable.

Limitations

• Exact 100% coverage is unconfirmed locally; CI will be the first to check it.
• The web's /@Laravel still matches case exactly, unlike this endpoint. That is left for a follow-up.

Summary by CodeRabbit

• New Features
  • Added a public API endpoint to retrieve a GitHub organization’s page as JSON using its handle. Handle lookup is case-insensitive, and the response preserves the organization’s stored handle casing.
  • Requests for handles that do not belong to an organization, or that cannot be found, return a not-found response.
• Documentation
  • Updated the public read API documentation with the organization endpoint. Authentication, visibility, pagination, and rate-limit details remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2a147d8a-2810-4337-a90d-15880af131b9

Commits

Reviewing files that changed from the base of the PR and between 3a6eabe and 431e176.

Files selected for processing: 5

• KNOWLEDGE_BASE.md
• app/Http/Controllers/Api/OrganizationController.php
• app/Http/Requests/ShowApiOrganizationRequest.php
• routes/api.php
• tests/Feature/Controllers/Api/OrganizationControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The API adds GET /api/v1/organizations/{organization} to return organization profile data. The request matches handles without case sensitivity and denies requests when the handle does not identify an organization profile.

Changes: Organization API

Layer / File(s)	Summary
Organization lookup and response app/Http/Requests/ShowApiOrganizationRequest.php, routes/api.php, app/Http/Controllers/Api/OrganizationController.php, tests/Feature/Controllers/Api/OrganizationControllerTest.php, KNOWLEDGE_BASE.md	The route connects the organization lookup request to a controller that returns the matched profile under data. Feature tests cover profile fields, case-insensitive lookup, and not-found responses. The documentation lists the controller and endpoint.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Route as api-organization.show
  participant Request as ShowApiOrganizationRequest
  participant Profiles as Profile records
  participant Controller as OrganizationController
  Client->>Route: GET organization handle
  Route->>Request: Resolve and authorize organization
  Request->>Profiles: Find organization by case-insensitive handle
  Profiles-->>Request: Matching profile or no match
  Request-->>Controller: Authorized request with profile
  Controller-->>Client: JSON response with profile under data

Loading

Possibly related issues

• dev-null-sh/dev-null.sh#938 — The endpoint can resolve organization profiles by handle, which supports organization mention resolution.
• dev-null-sh/dev-null.sh#857 — The documentation now includes the organization endpoint for the public API.

Possibly related PRs

• dev-null-sh/dev-null.sh#1262 — This PR adds the API representation for the organization profiles introduced in that PR.
• dev-null-sh/dev-null.sh#1156 — This endpoint uses the Profile model introduced in that PR.

Suggested reviewers: mnapoli, nunomaduro

Merge Risk: Minimal · up to 431e1

The endpoint is ready to merge, with no actionable risk identified.

Security architecture risk: Minimal · up to 431e1

The endpoint exposes the same limited organization-profile fields already available on the web. It preserves existing authentication and throttling controls, restricts lookup to organizations, and does not modify profile data. No material security risk introduced or worsened by this change was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — An unauthenticated caller can query persisted organization profiles by handle, not just organizations mentioned to that caller. The returned scope is limited to the six public profile fields already used by the web page; internal identifiers, synchronization timestamps, and the user relation are outside the serialization allowlist.

Trust Boundaries and Controls

• observed — The organization-type predicate prevents user-profile selection, and parameter binding separates the untrusted handle from SQL syntax. For unsigned requests, the existing middleware temporarily removes any ambient authenticated user and restores it in a finally block, including when downstream processing throws.

Resilience and Maintainability Implications

• observed — The shared serialization allowlist is backed by an added exact-JSON assertion that excludes additional model fields. This provides a regression check against accidental response expansion, although the tests were inspected rather than executed during this review.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding organizations to the API.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 4 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[rohitsasi720]

Closing this: f8e60e2 (feat: orgs on the native mac os app) added the same GET /api/v1/organizations/{handle} endpoint to production, and it's already live. The mobile app (NativePHP/dev-null-app#122) works against it as it is.

One difference, in case it's worth a follow-up: this PR matched the handle in any case (LOWER(handle) = ?), because a mention keeps the case it was written in. The endpoint on production matches it exactly, so /api/v1/organizations/Laravel returns 404 while /laravel returns the organization.