diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 4793058e9..ede9e29e3 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -453,6 +453,12 @@ export const authLoginServiceFactory = ({ const selectedOrg = await orgDAL.findById(organizationId); + if (!selectedOrgMembership) { + throw new ForbiddenRequestError({ + message: `User does not have access to the organization named ${selectedOrg?.name}` + }); + } + // Check if authEnforced is true and the current auth method is not an enforced method if ( selectedOrg.authEnforced && @@ -465,12 +471,6 @@ export const authLoginServiceFactory = ({ }); } - if (!selectedOrgMembership) { - throw new ForbiddenRequestError({ - message: `User does not have access to the organization named ${selectedOrg?.name}` - }); - } - if (selectedOrg.googleSsoAuthEnforced && decodedToken.authMethod !== AuthMethod.GOOGLE) { const canBypass = selectedOrg.bypassOrgAuthEnabled && selectedOrgMembership.userRole === OrgMembershipRole.Admin;