fix: get bookings handler for pbac and fallback roles

[tomerqodo]

Benchmark PR from agentic-review-benchmarks#1

---

Note

Strengthens bookings access control by using PBAC with fallback roles and optional org scoping, and refactors permission queries for clarity and reuse.

• Viewer bookings get.handler now uses PermissionCheckService to derive accessible team/user scope via booking.read, combining PBAC and ADMIN/OWNER fallback roles; rejects unauthorized userIds filters
• PermissionRepository adds optional orgId scoping to getTeamIdsWithPermission(s) and splits SQL into getTeamsWithPBACPermissions and getTeamsWithFallbackRoles; supports org->child team resolution
• PermissionCheckService threads orgId through team ID resolution; minor cleanups
• New tests: booking handler PBAC scenarios and org-scoped repository integration (including child teams)

^{Written by Cursor Bugbot for commit 544a43b. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

orgId parameter not forwarded in getTeamIdsWithPermission

High Severity

The orgId parameter is destructured from the input in getTeamIdsWithPermission but never passed to getTeamIdsWithPermissions. The call at line 222 forwards userId, permissions, and fallbackRoles, but omits orgId. This means organization-scoped filtering won't work when using the singular getTeamIdsWithPermission method, defeating the purpose of the new orgId parameter added in this PR.

 

[cursor]

Permission bypass allows accessing other users' bookings

High Severity

The isCurrentUser check was changed from filters.userIds.length === 1 && user.id === filters.userIds[0] to filters.userIds.includes(user.id). This allows users to bypass permission checks by including their own ID alongside other user IDs they lack permission to access. Since the subsequent query uses all filters.userIds, unauthorized users' bookings will be returned.