Add migration to fix wrong GIDs

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/migrations/20251006T220024Z.sql

@@ -34,7 +34,7 @@ CREATE TABLE authz_invitations (
 INSERT INTO authz_memberships (tenant_id, id, user_id, organization_id, role, created_at, updated_at)
 SELECT
     organizations.tenant_id,
-    generate_gid(decode_base64_unpadded(organizations.tenant_id), 38) as id,
+    generate_gid(decode_base64_unpadded(organizations.tenant_id), 39) as id,
     users_organizations.user_id,
     users_organizations.organization_id,
     'MEMBER'::authz_role as role,  -- Default role for existing memberships

pkg/coredata/migrations/20260119T182800.sql

@@ -0,0 +1,9 @@
+UPDATE
+    iam_memberships m
+SET
+    id = generate_gid(decode_base64_unpadded(o.tenant_id), 39)
+FROM
+    organizations o
+WHERE
+    o.id = m.organization_id
+    AND extract_entity_type(parse_gid(m.id)) = 38;

pkg/iam/iam_policies.go

@@ -135,7 +135,10 @@ var IAMOwnerPolicy = policy.NewPolicy(
 		ActionMembershipDelete,
 	).
 		WithSID("membership-deletion-owner-access").
-		When(policy.NotEquals("resource.source", "SCIM")),
+		When(
+			policy.Equals("principal.organization_id", "resource.organization_id"),
+			policy.NotEquals("resource.source", "SCIM"),
+		),
 
 	// Can set other members OWNER
 	policy.Allow(ActionMembershipRoleSetOwner).