add org policy check to verify session

2026-02-25 22:36:38 +00:00 · 2025-10-25 17:15:37 -07:00
parent 9ce81b34c9
commit 8973726f63
4 changed files with 113 additions and 5 deletions
--- a/server/private/lib/checkOrgAccessPolicy.ts
+++ b/server/private/lib/checkOrgAccessPolicy.ts
@@ -95,6 +95,13 @@ export async function checkOrgAccessPolicy(
        }
    }

+    if (props.session.userId !== props.user.userId) {
+        return {
+            allowed: false,
+            error: "Session does not belong to the user"
+        };
+    }
+
    // now check the policies
    const policies: CheckOrgAccessPolicyResult["policies"] = {};