Change membershipResolver.Profile to authz from membership

Signed-off-by: Émile Ré <emile@getprobo.com>

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+### Changed
+
+- Membership Profile authz done from membership in membershipResolver (it's a 1:1 association)
+
 ## [0.116.1] - 2026-01-18
 
 ### Fixed

pkg/iam/account_service.go

@@ -843,7 +843,7 @@ func (s AccountService) GetProfileForMembership(ctx context.Context, membershipI
 			membership := &coredata.Membership{}
 			err := membership.LoadByID(ctx, conn, scope, membershipID)
 			if err != nil {
-				if err == coredata.ErrResourceNotFound {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
 					return NewMembershipNotFoundError(membershipID)
 				}
 
@@ -852,11 +852,11 @@ func (s AccountService) GetProfileForMembership(ctx context.Context, membershipI
 
 			err = profile.LoadByMembershipID(ctx, conn, scope, membershipID)
 			if err != nil {
-				if err == coredata.ErrResourceNotFound {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
 					return NewProfileNotFoundError(membershipID)
 				}
 
-				return fmt.Errorf("cannot load identity profile: %w", err)
+				return fmt.Errorf("cannot load membership profile: %w", err)
 			}
 
 			return nil

pkg/server/api/connect/v1/v1_resolver.go

@@ -246,23 +246,21 @@ func (r *membershipResolver) Identity(ctx context.Context, obj *types.Membership
 
 // Profile is the resolver for the profile field.
 func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership) (*types.MembershipProfile, error) {
-	// TODO: PorfileID must leave on membership to allow perform the ACL lookup first and load after.
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+		return nil, err
+	}
 
 	profile, err := r.iam.AccountService.GetProfileForMembership(ctx, obj.ID)
 	if err != nil {
 		var errProfileNotFound *iam.ErrProfileNotFound
 		if errors.As(err, &errProfileNotFound) {
-			return nil, nil
+			return nil, gqlutils.NotFound(ctx, err)
 		}
 
 		r.logger.ErrorCtx(ctx, "cannot get profile for membership", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	if err := r.authorize(ctx, profile.ID, iam.ActionMembershipProfileGet); err != nil {
-		return nil, err
-	}
-
 	return types.NewMembershipProfile(profile), nil
 }