fix(authz): close DeleteMembership authorization bypass

Merged
MA
4mo ago
+63-3

Closes PFM-6498

Summary

  • Add explicit ServerOperationsMap entries for OrganizationService/DeleteMembership and UpdateMembership, requiring org admin/owner membership-management policies.
  • Introduce PolicyOrganizationMembershipsDelete and PolicyOrganizationMembershipsUpdate and grant them to RoleAdmin and RoleOwner.
  • Prevents any org member (including viewers) from removing or updating other members via the unanchored regex match on the empty OrganizationService/Delete policy.