use can_view_org instead so roles like auditors can view

Author: adelowo

internal/ent/hooks/usersettings.go

@@ -84,10 +84,11 @@ func allowDefaultOrgUpdate(ctx context.Context, m *generated.UserSettingMutation
 		SubjectID:   owner.ID,
 		SubjectType: auth.UserSubjectType,
 		ObjectID:    orgID,
+		Relation:    "can_view_org",
 		Context:     utils.NewOrganizationContextKey(usCaller.SubjectEmail),
 	}
 
-	allow, err := m.Authz.CheckOrgReadAccess(ctx, req)
+	allow, err := m.Authz.CheckOrgAccess(ctx, req)
 	if err != nil {
 		return false
 	}

internal/httpserve/authmanager/authmanager.go

@@ -262,15 +262,16 @@ func (a *Client) authCheck(ctx context.Context, user *generated.User, orgID stri
 		orgID = caller.OrganizationID
 	}
 
-	// ensure user is already a member of the destination organization
+	// ensure user can access the destination organization
 	req := fgax.AccessCheck{
 		SubjectID:   caller.SubjectID,
 		SubjectType: auth.UserSubjectType,
 		ObjectID:    orgID,
+		Relation:    "can_view_org",
 		Context:     utils.NewOrganizationContextKey(caller.SubjectEmail),
 	}
 
-	allow, err := a.db.Authz.CheckOrgReadAccess(ctx, req)
+	allow, err := a.db.Authz.CheckOrgAccess(ctx, req)
 	if err != nil {
 		logx.FromContext(ctx).Error().Err(err).Str("user_id", caller.SubjectID).Str("org_id", orgID).Msg("unable to check org read access")