Catch assumption needed errors

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/iam/authorizer.go

@@ -99,7 +99,7 @@ func (a *Authorizer) authorize(ctx context.Context, conn pg.Conn, params Authori
 			var errSessionExpired *ErrSessionExpired
 
 			if errors.As(err, &errSessionNotFound) || errors.As(err, &errSessionExpired) {
-				return NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action)
+				return NewAssumptionNeededError(params.Principal, membership.ID)
 			}
 
 			return fmt.Errorf("cannot get active child session for membership: %w", err)