ndi.cloud.authenticate silently uses the first organization for multi-org users #1005

Summary

When a user's NDI Cloud login response contains more than one organization, ndi.cloud.authenticate silently selects the first organization and warns, rather than letting the caller choose. Every subsequent Cloud API call (getDataset, files, documents, …) is then scoped to that arbitrarily-chosen org, so a user who belongs to multiple organizations can silently operate against the wrong one — or be unable to reach a dataset that lives in a non-first org.

Observed

Any ndi.cloud.api.* call made by a multi-org account prints:

Warning: Login response contained 3 organizations; using the first ("649b1b1bea20f31db68d4f9f").
Selection among multiple organizations is not yet supported.
> In ndi.cloud.authenticate>extractFirstOrganizationId (line 193)
In ndi.cloud.authenticate>login (line 158)
In ndi.cloud.authenticate>authenticatedWithSecret (line 90)
In ndi.cloud.authenticate (line 42)
In ndi.cloud.api.implementation.datasets/GetDataset/execute (line 36)
In ndi.cloud.api.datasets.getDataset (line 28)

In the case that surfaced this, the first org happened to be the right one, so the call succeeded — but that is luck, not correctness.

Impact

• Correctness: a multi-org user's calls are scoped to organizations[1] regardless of which org owns the dataset/resource they asked for. If the target lives in another org, calls fail (or, worse, silently act on a same-id resource in the wrong org).
• Scope: this is in the shared auth layer (ndi.cloud.authenticate → extractFirstOrganizationId), so it affects all ndi.cloud.api.* families, not just one endpoint. Related but narrower: ndi.cloud.api.compute.* should require an explicit organizationId; picking the first silently is wrong for multi-org users #936 (closed) raised the same "pick the first silently" problem specifically for ndi.cloud.api.compute.*.

Suggested direction

• Let the caller supply the organization explicitly (name-value option threaded through ndi.cloud.authenticate and the API wrappers), and/or a session-level default the user sets once.
• When multiple orgs are present and none is specified, prefer a clear error (or an interactive/selectable prompt) over silently taking the first — at minimum for write/publish operations.
• Provide a helper to list the authenticated user's organizations so callers can pick programmatically.

Notes

Discovered incidentally while validating the files-collection migration (getDataset/listFilesAll worked because the first org matched). Filing so it is tracked; not urgent, but it is a latent correctness bug for any multi-org user.