add GetMembersByOrganization permission

services/user-svc/internal/organization/organization.go

@@ -602,29 +602,14 @@ func (s ServiceServer) GetMembersByOrganization(
 		return nil, status.Error(codes.Internal, err.Error())
 	}
 
-	userID := auth.MustGetUserID(ctx)
-
-	doesOrganizationExist, err := organizationRepo.DoesOrganizationExist(ctx, organizationID)
-	err = hwdb.Error(ctx, err)
-	if err != nil {
-		return nil, err
-	} else if !doesOrganizationExist {
-		return &pb.GetMembersByOrganizationResponse{}, nil
-	}
-
-	hasAccess, err := organizationRepo.IsInOrganizationById(ctx, organization_repo.IsInOrganizationByIdParams{
-		Organizationid: organizationID,
-		Userid:         userID,
-	})
-	err = hwdb.Error(ctx, err)
-	if err != nil {
+	// check permission
+	user := commonPerm.UserFromCtx(ctx)
+	check := hwauthz.NewPermissionCheck(
+		user, perm.OrganizationCanUserGetMembers, commonPerm.Organization(organizationID))
+	if err := s.authz.Must(ctx, check); err != nil {
 		return nil, err
 	}
 
-	if !hasAccess {
-		return nil, status.Error(codes.Unauthenticated, "Not a member of this organization")
-	}
-
 	members, err := organizationRepo.GetMembersByOrganization(ctx, organizationID)
 	err = hwdb.Error(ctx, err)
 	if err != nil {

services/user-svc/internal/organization/perm/perm.go

@@ -18,6 +18,7 @@ const (
 	OrganizationCanUserGet          = "get"
 	OrganizationCanUserUpdate       = "update"
 	OrganizationCanUserDelete       = "delete"
+	OrganizationCanUserGetMembers   = "get_members"
 	OrganizationCanUserInviteMember = "invite_member"
 	OrganizationCanUserRemoveMember = "remove_member"
 )

spicedb/organization.zed

@@ -9,6 +9,7 @@ definition organization {
 
 	// all members can get the organization
 	permission get = membership;
+	permission get_members = get;
 
 	// (only) leaders can update and delete an organization
 	permission update = leadership;