Merge commit from fork

* fix: add `Scopes` to `Request` interface so that scopes can be validated on all requests

* feat: assert org from scope exists when authorizing requests

* fix: check all scopes

* comments

* check org on callback creation

* fix tests

* clarifications

* fix scope marshaling

* fix: enfore organization for authrequest in initiation

* fix: filter sessions on the accounts page by organization scope

* add integration tests

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>

internal/command/auth_request_model.go

@@ -37,6 +37,7 @@ type AuthRequestWriteModel struct {
 	AuthRequestState domain.AuthRequestState
 	NeedRefreshToken bool
 	Issuer           string
+	OrganizationID   string
 }
 
 func NewAuthRequestWriteModel(ctx context.Context, id string) *AuthRequestWriteModel {
@@ -70,6 +71,7 @@ func (m *AuthRequestWriteModel) Reduce() error {
 			m.AuthRequestState = domain.AuthRequestStateAdded
 			m.NeedRefreshToken = e.NeedRefreshToken
 			m.Issuer = e.Issuer
+			m.OrganizationID = e.OrganizationID
 		case *authrequest.SessionLinkedEvent:
 			m.SessionID = e.SessionID
 			m.UserID = e.UserID