fix: scope organization access by membership

backend/src/Socialize.Api/Modules/Organizations/Services/OrganizationAccessService.cs

@@ -2,29 +2,16 @@ using System.Security.Claims;
 using Microsoft.EntityFrameworkCore;
 using Socialize.Api.Data;
 using Socialize.Api.Infrastructure.Security;
-using Socialize.Api.Modules.Identity.Contracts;
 
 namespace Socialize.Api.Modules.Organizations.Services;
 
 internal sealed class OrganizationAccessService(
     AppDbContext dbContext)
 {
-    public static bool IsGlobalManager(ClaimsPrincipal user)
-    {
-        return user.IsInRole(KnownRoles.Administrator) || user.IsInRole(KnownRoles.Manager);
-    }
-
     public async Task<IReadOnlyCollection<Guid>> GetAccessibleOrganizationIdsAsync(
         ClaimsPrincipal user,
         CancellationToken ct)
     {
-        if (IsGlobalManager(user))
-        {
-            return await dbContext.Organizations
-                .Select(organization => organization.Id)
-                .ToArrayAsync(ct);
-        }
-
         Guid userId = user.GetUserId();
 
         Guid[] ownedOrganizationIds = await dbContext.Organizations
@@ -47,13 +34,6 @@ internal sealed class OrganizationAccessService(
         ClaimsPrincipal user,
         CancellationToken ct)
     {
-        if (IsGlobalManager(user))
-        {
-            return await dbContext.Workspaces
-                .Select(workspace => workspace.Id)
-                .ToArrayAsync(ct);
-        }
-
         Guid[] directWorkspaceIds = user.GetWorkspaceScopeIds().ToArray();
         Guid[] organizationWorkspaceIds = await GetInheritedWorkspaceIdsAsync(user, OrganizationPermissions.AccessOwnedWorkspaces, ct);
 
@@ -68,11 +48,6 @@ internal sealed class OrganizationAccessService(
         Guid organizationId,
         CancellationToken ct)
     {
-        if (IsGlobalManager(user))
-        {
-            return true;
-        }
-
         Guid userId = user.GetUserId();
 
         return await dbContext.Organizations.AnyAsync(
@@ -89,11 +64,6 @@ internal sealed class OrganizationAccessService(
         string permission,
         CancellationToken ct)
     {
-        if (IsGlobalManager(user))
-        {
-            return true;
-        }
-
         Guid userId = user.GetUserId();
 
         bool owner = await dbContext.Organizations.AnyAsync(
@@ -117,11 +87,6 @@ internal sealed class OrganizationAccessService(
         Guid organizationId,
         CancellationToken ct)
     {
-        if (IsGlobalManager(user))
-        {
-            return OrganizationPermissionRules.GetPermissionsForRole(OrganizationRoles.Owner);
-        }
-
         Guid userId = user.GetUserId();
 
         bool owner = await dbContext.Organizations.AnyAsync(
@@ -150,11 +115,6 @@ internal sealed class OrganizationAccessService(
         string permission,
         CancellationToken ct)
     {
-        if (IsGlobalManager(user))
-        {
-            return true;
-        }
-
         Guid? organizationId = await dbContext.Workspaces
             .Where(workspace => workspace.Id == workspaceId)
             .Select(workspace => (Guid?)workspace.OrganizationId)