diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index b2d6281cc..96fe5fff0 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -536,6 +536,20 @@ export const authLoginServiceFactory = ({ const user = await userDAL.findUserEncKeyByUserId(decodedToken.userId); if (!user) throw new BadRequestError({ message: "User not found", name: "Find user from token" }); + // Check user membership in the sub-organization + const orgMembership = await membershipUserDAL.findOne({ + actorUserId: user.id, + scopeOrgId: organizationId, + scope: AccessScope.Organization, + status: OrgMembershipStatus.Accepted + }); + + if (!orgMembership) { + throw new ForbiddenRequestError({ + message: `User does not have access to the organization with ID ${organizationId}` + }); + } + const selectedOrg = await orgDAL.findById(organizationId); if (!selectedOrg) { throw new NotFoundError({ message: `Organization with ID '${organizationId}' not found` }); @@ -552,20 +566,6 @@ export const authLoginServiceFactory = ({ }); } - // Check user membership in the sub-organization - const orgMembership = await membershipUserDAL.findOne({ - actorUserId: user.id, - scopeOrgId: organizationId, - scope: AccessScope.Organization, - status: OrgMembershipStatus.Accepted - }); - - if (!orgMembership) { - throw new ForbiddenRequestError({ - message: `User does not have access to the sub-organization named ${selectedOrg.name}` - }); - } - // Check user membership in the root organization const rootOrgMembership = await membershipUserDAL.findOne({ actorUserId: user.id,