Merge commit from fork

* fix: add `Scopes` to `Request` interface so that scopes can be validated on all requests

* feat: assert org from scope exists when authorizing requests

* fix: check all scopes

* comments

* check org on callback creation

* fix tests

* clarifications

* fix scope marshaling

* fix: enfore organization for authrequest in initiation

* fix: filter sessions on the accounts page by organization scope

* add integration tests

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>

apps/login/src/lib/session.ts

@@ -142,13 +142,15 @@ export async function findValidSession({
   sessions,
   authRequest,
   samlRequest,
+  organization,
 }: {
   serviceConfig: ServiceConfig;
   sessions: Session[];
   authRequest?: AuthRequest;
   samlRequest?: SAMLRequest;
+  organization?: string;
 }): Promise<Session | undefined> {
-  const sessionsWithHint = sessions.filter((s) => {
+  let sessionsWithHint = sessions.filter((s) => {
     if (authRequest && authRequest.hintUserId) {
       return s.factors?.user?.id === authRequest.hintUserId;
     }
@@ -163,6 +165,10 @@ export async function findValidSession({
     return true;
   });
 
+  if (organization) {
+    sessionsWithHint = sessionsWithHint.filter((s) => s.factors?.user?.organizationId === organization);
+  }
+
   if (sessionsWithHint.length === 0) {
     return undefined;
   }