Implement organization assumption check in authorization layer

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/session.go

@@ -341,7 +341,12 @@ WHERE
 	return result.RowsAffected(), nil
 }
 
-func (s *Session) LoadByRootSessionIDAndMembershipID(ctx context.Context, conn pg.Conn, rootSessionID gid.GID, membershipID gid.GID) error {
+func (s *Session) LoadByRootSessionIDAndMembershipID(
+	ctx context.Context,
+	conn pg.Conn,
+	rootSessionID gid.GID,
+	membershipID gid.GID,
+) error {
 	q := `
 SELECT
     id,
@@ -390,3 +395,58 @@ LIMIT 1
 
 	return nil
 }
+
+func (s *Session) LoadByRootSessionIDAndOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	rootSessionID gid.GID,
+	organizationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    identity_id,
+    tenant_id,
+    membership_id,
+    data,
+    parent_session_id,
+    auth_method,
+    authenticated_at,
+    expire_reason,
+    user_agent,
+    ip_address,
+    expired_at,
+    created_at,
+    updated_at
+FROM
+    iam_sessions
+WHERE
+    parent_session_id = @root_session_id
+    AND organization_id = @organization_id
+ORDER BY created_at DESC
+LIMIT 1
+`
+
+	args := pgx.StrictNamedArgs{
+		"root_session_id": rootSessionID,
+		"organization_id": organizationID,
+	}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query session: %w", err)
+	}
+
+	session, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Session])
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect session: %w", err)
+	}
+
+	*s = session
+
+	return nil
+}