From f396107090cdd0a93e43524b9289c57f40124d25 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 27 Jul 2026 14:11:49 +0000 Subject: [PATCH] Drop redundant access source organization checks Scoped LoadByID already enforces tenant isolation; remove OrganizationID comparisons against the campaign in create, sync, add source, and review engine paths. Signed-off-by: Cursor Agent Co-authored-by: Bryan FRIMIN --- pkg/accessreview/campaign_service.go | 12 ------------ pkg/accessreview/review_engine.go | 4 ---- 2 files changed, 16 deletions(-) diff --git a/pkg/accessreview/campaign_service.go b/pkg/accessreview/campaign_service.go index 0d015f434..6658af7aa 100644 --- a/pkg/accessreview/campaign_service.go +++ b/pkg/accessreview/campaign_service.go @@ -69,10 +69,6 @@ func (s *Service) CreateCampaign( return fmt.Errorf("cannot load access source: %w", err) } - if source.OrganizationID != campaign.OrganizationID { - return coredata.ErrResourceNotFound - } - if err := s.upsertCampaignSource(ctx, conn, scope, campaign.ID, source); err != nil { return fmt.Errorf("cannot snapshot scope source: %w", err) } @@ -252,10 +248,6 @@ func (s *Service) AddCampaignSource( return fmt.Errorf("cannot load access source: %w", err) } - if source.OrganizationID != campaign.OrganizationID { - return coredata.ErrResourceNotFound - } - if err := s.upsertCampaignSource(ctx, conn, scope, campaign.ID, source); err != nil { return fmt.Errorf("cannot snapshot scope source: %w", err) } @@ -340,10 +332,6 @@ func (s *Service) syncCampaignSources( return fmt.Errorf("cannot load access source: %w", err) } - if source.OrganizationID != campaign.OrganizationID { - return coredata.ErrResourceNotFound - } - if err := s.upsertCampaignSource(ctx, conn, scope, campaign.ID, source); err != nil { return fmt.Errorf("cannot snapshot scope source: %w", err) } diff --git a/pkg/accessreview/review_engine.go b/pkg/accessreview/review_engine.go index 3f293cf66..2d5c101ad 100644 --- a/pkg/accessreview/review_engine.go +++ b/pkg/accessreview/review_engine.go @@ -67,10 +67,6 @@ func (s *Service) FetchSource( return fmt.Errorf("cannot load access source %s: %w", sourceID, err) } - if source.OrganizationID != campaign.OrganizationID { - return fmt.Errorf("cannot process access source: %s does not belong to campaign organization", sourceID) - } - var err error driver, err = s.resolveDriver(ctx, tx, scope, source)