Enforce owner-only member removal and ownership grants via policy

An organization ADMIN could hard-remove members, including OWNERs, because
removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete
gate. Authorize the owner-only iam:membership:delete instead, and expose the
source attribute on MembershipProfile so the owner grant's non-SCIM condition
can match.

Consolidate ownership-grant authorization into policy for both createUser and
updateMembership: each resolver passes the requested role as a target_role
attribute and ADMIN is denied granting ownership via deny-create-owner /
deny-promote-owner. target_role is distinct from resource.role, which is the
target's current role and guards editing existing owners. With no callers left,
the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed.

Also pass the authorized scope through to the RemoveUser/CreateUser services,
gate the console Remove action on iam:membership:delete, and add regression
tests plus a changelog entry.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/iam/iam_actions.go

@@ -48,9 +48,6 @@ const (
 	ActionMembershipUpdate = "iam:membership:update"
 	ActionMembershipDelete = "iam:membership:delete"
 
-	// Membership role actions
-	ActionMembershipRoleSetOwner = "iam:membership-role:set-owner"
-
 	// Membership Profile actions
 	ActionMembershipProfileGet        = "iam:membership-profile:get"
 	ActionMembershipProfileList       = "iam:membership-profile:list"

pkg/iam/iam_policies.go

@@ -183,11 +183,6 @@ var IAMOwnerPolicy = policy.NewPolicy(
 			policy.NotEquals("resource.source", "SCIM"),
 		),
 
-	// Can set other members OWNER
-	policy.Allow(ActionMembershipRoleSetOwner).
-		WithSID("membership-role-owner-access").
-		When(policy.Equals("principal.organization_id", "resource.organization_id")),
-
 	// Full access to membership profiles (scoped to own organization)
 	policy.Allow(
 		ActionMembershipProfileGet,
@@ -318,6 +313,15 @@ var IAMAdminPolicy = policy.NewPolicy(
 	policy.Deny(ActionMembershipDelete).
 		WithSID("deny-remove-member"),
 
+	// Cannot grant ownership, whether by creating an OWNER member or promoting an
+	// existing member to OWNER (only owner can grant ownership)
+	policy.Deny(ActionMembershipProfileCreate).
+		WithSID("deny-create-owner").
+		When(policy.Equals("resource.target_role", "OWNER")),
+	policy.Deny(ActionMembershipUpdate).
+		WithSID("deny-promote-owner").
+		When(policy.Equals("resource.target_role", "OWNER")),
+
 	// Cannot manage SAML configurations (only owner can)
 	policy.Deny(
 		ActionSAMLConfigurationCreate,

pkg/iam/oauth2_scopes.go

@@ -85,7 +85,6 @@ var IAMOAuth2ScopeMappings = map[coredata.OAuth2Scope][]string{
 		ActionInvitationDelete,
 		ActionMembershipUpdate,
 		ActionMembershipDelete,
-		ActionMembershipRoleSetOwner,
 		ActionMembershipProfileCreate,
 		ActionMembershipProfileUpdate,
 		ActionMembershipProfileDelete,

pkg/iam/organization_service.go

@@ -309,11 +309,10 @@ func (s *OrganizationService) UpdateMembership(
 
 func (s *OrganizationService) RemoveUser(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	profileID gid.GID,
 ) error {
-	scope := coredata.NewScopeFromObjectID(organizationID)
-
 	return s.pg.WithTx(
 		ctx,
 		func(ctx context.Context, tx pg.Tx) error {
@@ -987,13 +986,12 @@ func (s *OrganizationService) DeleteOrganization(ctx context.Context, organizati
 	)
 }
 
-func (s *OrganizationService) CreateUser(ctx context.Context, req *CreateUserRequest) (*coredata.MembershipProfile, error) {
+func (s *OrganizationService) CreateUser(ctx context.Context, scope coredata.Scoper, req *CreateUserRequest) (*coredata.MembershipProfile, error) {
 	if err := req.Validate(); err != nil {
 		return nil, fmt.Errorf("invalid request: %w", err)
 	}
 
 	var (
-		scope   = coredata.NewScopeFromObjectID(req.OrganizationID)
 		profile *coredata.MembershipProfile
 		now     = time.Now()
 	)