Refactor auth extractor

[wumbabum]

Description

WIP

GitHub Issue: [Closes|Fixes|Resolves] #your GitHub issue number here

Changes

• ...
• ...
• ...

Testing Strategy

describe how you or someone else can test and verify the changes

Concerns

describe any concerns that might be worth mentioning or discussing

[Copilot]

Pull request overview

Adds a new Axum request-parts extractor to centralize “organization admin” authorization checks (SuperAdmin global access or Admin scoped to the organization_id in the route path), along with integration-style tests using the existing mock DB/auth-session setup.

Changes:

• Introduces OrganizationAdminAccess extractor that validates organization_id path params, verifies the organization exists, and enforces admin authorization via the authenticated user’s roles.
• Adds integration tests (behind mock feature) covering Admin, SuperAdmin, and unauthorized scenarios.
• Exposes the new extractor module via web::extractors::mod.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
web/src/extractors/organization_admin_access.rs	New admin-authorization extractor for organization-scoped routes + tests.
web/src/extractors/mod.rs	Registers the new organization_admin_access extractor module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

web/src/extractors/organization_admin_access.rs:75

• The boolean expression inside .any() mixes && and || without parentheses. Rust precedence makes it work today, but it’s easy to misread and fragile to future edits; adding explicit grouping (or splitting into named booleans) will make the authorization rule unambiguous.

            .any(|r| {
                r.role == domain::users::Role::SuperAdmin && r.organization_id.is_none()
                    || r.role == domain::users::Role::Admin
                        && r.organization_id == Some(organization_id)
            })