**Issue:** Critical security vulnerability - inverted return value grants unauthorized access

**Context:** The isLoggedInUserOrgAdminOfBookingHost method checks if a booking user is a member of an org where the logged-in user is admin. When no membership is found, it incorrectly returns true, granting unauthorized access.

**Recommended files to fix:**
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[46-46]

**Fix:** Change line 46 from `if (!bookingUserOrgMembership) return true;` to `if (!bookingUserOrgMembership) return false;`. When the booking user is not a member of any org where the logged-in user is admin, the logged-in user should NOT be considered an org admin of the booking user.

**Issue:** Critical logic error in org admin authorization check

**Context:** The isLoggedInUserOrgAdminOfBookingHost method is checking if a logged-in user is an org admin of a booking host. The early return condition is inverted, causing all org admins to be denied authorization.

**Recommended files to fix:**
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[27-29]

**Fix:** Change line 27 from `if (orgIdsWhereLoggedInUserAdmin.length > 0) {` to `if (orgIdsWhereLoggedInUserAdmin.length === 0) {`. The logic should return false when the user is NOT an admin of any org (length === 0), not when they ARE an admin (length > 0).

**Issue:** Missing NOT operator in authorization check prevents org admins from canceling bookings

**Context:** The handleCancelBooking function checks if a user is authorized to cancel a seated booking. The condition should throw an error when the user lacks all three authorizations (not host, not owner, not org admin), but currently throws when they ARE an org admin.

**Recommended files to fix:**
- packages/features/bookings/lib/handleCancelBooking.ts[156-161]

**Fix:** Change line 156 from `if (!userIsHost && !userIsOwnerOfEventType && userIsOrgAdminOfBookingUser) {` to `if (!userIsHost && !userIsOwnerOfEventType && !userIsOrgAdminOfBookingUser) {`. Add the NOT operator (!) before userIsOrgAdminOfBookingUser so the error is thrown when the user is NOT authorized, not when they ARE authorized.

**Issue:** Parameters passed in wrong order to authorization check method

**Context:** The isIndividualSeatOrOrgAdminReschedule method calls isLoggedInUserOrgAdminOfBookingHost to check if the logged-in user is an org admin of the booking user. The parameters are currently swapped, causing the check to evaluate backwards.

**Recommended files to fix:**
- apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts[894-897]

**Fix:** Swap the parameters on lines 895-896. Change from `bookingUserId, authUserId` to `authUserId, bookingUserId`. The method signature is `isLoggedInUserOrgAdminOfBookingHost(loggedInUserId: number, bookingUserId: number)`, so authUserId should be first and bookingUserId should be second.

**Issue**: Security vulnerability - function returns true when it should return false, granting unauthorized access.

**Context**: When bookingUserOrgMembership is null/undefined, it means the booking user is not a member of any org where the logged-in user is admin. This should result in returning false (no authorization), not true.

**Recommended files to fix**:
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[46-46]

**Fix**: Change line 46 from `if (!bookingUserOrgMembership) return true;` to `if (!bookingUserOrgMembership) return false;`. This ensures unauthorized users are correctly denied access.

**Issue**: Parameters passed in wrong order to isLoggedInUserOrgAdminOfBookingHost, causing incorrect authorization checks.

**Context**: The function signature is isLoggedInUserOrgAdminOfBookingHost(loggedInUserId: number, bookingUserId: number), but the call passes (bookingUserId, authUserId) which is backwards.

**Recommended files to fix**:
- apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts[894-897]

**Fix**: Swap the parameters at lines 895-896 to pass authUserId as the first parameter and bookingUserId as the second parameter. Change from `isLoggedInUserOrgAdminOfBookingHost(bookingUserId, authUserId)` to `isLoggedInUserOrgAdminOfBookingHost(authUserId, bookingUserId)`.

**Issue**: Inverted authorization logic throws 401 error when user IS an org admin instead of when they are NOT.

**Context**: The condition should deny access only when the user lacks all three authorizations: not a host, not an owner, and not an org admin. Currently it denies access when the user IS an org admin.

**Recommended files to fix**:
- packages/features/bookings/lib/handleCancelBooking.ts[156-161]

**Fix**: Add the NOT operator to userIsOrgAdminOfBookingUser in the condition at line 156. Change from `if (!userIsHost && !userIsOwnerOfEventType && userIsOrgAdminOfBookingUser)` to `if (!userIsHost && !userIsOwnerOfEventType && !userIsOrgAdminOfBookingUser)`. This ensures the error is thrown only when the user lacks all three authorizations.

**Issue**: Inverted logic in org admin check causes function to return false when user IS an admin.

**Context**: The isLoggedInUserOrgAdminOfBookingHost function should return true if the logged-in user is an org admin of the booking host. The early return at line 27-29 should only trigger when the user is NOT an admin of any org.

**Recommended files to fix**:
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[27-29]

**Fix**: Change line 27 from `if (orgIdsWhereLoggedInUserAdmin.length > 0)` to `if (orgIdsWhereLoggedInUserAdmin.length === 0)`. This ensures the function returns false early only when the user is not an admin of any organization, and continues checking when they are an admin.

## Issue
Line 46 in packages/lib/server/repository/PrismaOrgMembershipRepository.ts[46-46] returns true when the booking user is NOT found in any org where the logged-in user is admin. This is a security vulnerability.

## Context
The function should return true only when the logged-in user IS an org admin of the booking host. If the booking user is not a member of any organization where the logged-in user is admin, the function should return false to deny access.

## Fix
Change line 46 from:
```typescript
if (!bookingUserOrgMembership) return true;
```
to:
```typescript
if (!bookingUserOrgMembership) return false;
```

## Files to Fix
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[46-46]

## Issue
The condition at line 27 in packages/lib/server/repository/PrismaOrgMembershipRepository.ts[27-29] is inverted. It returns false when the user IS an org admin.

## Context
The function isLoggedInUserOrgAdminOfBookingHost should return true if the logged-in user is an org admin of the booking host's organization. The early return should only happen when the user is NOT an admin of any org.

## Fix
Change line 27 from:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length > 0) {
```
to:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length === 0) {
```

## Files to Fix
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[27-27]

## Issue
Line 156 in packages/features/bookings/lib/handleCancelBooking.ts[156-161] throws an error when the user IS an org admin, blocking legitimate cancellations.

## Context
The authorization check should allow org admins to cancel seated bookings for their organization members. The error should only be thrown when the user is NOT a host, NOT an owner, AND NOT an org admin. The similar logic in rescheduleSeatedBooking.ts:111 correctly uses '!isOrgAdmin'.

## Fix
Change line 156 from:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && userIsOrgAdminOfBookingUser) {
```
to:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && !userIsOrgAdminOfBookingUser) {
```

## Files to Fix
- packages/features/bookings/lib/handleCancelBooking.ts[156-156]

## Issue
Lines 894-896 in apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts[894-897] pass parameters in the wrong order to isLoggedInUserOrgAdminOfBookingHost.

## Context
The function signature is isLoggedInUserOrgAdminOfBookingHost(loggedInUserId: number, bookingUserId: number). The first parameter should be the logged-in user (authUserId) and the second should be the booking user (bookingUserId). All other call sites in the codebase pass parameters correctly.

## Fix
Change lines 894-896 from:
```typescript
const isOrgAdmin = await PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost(
  bookingUserId,
  authUserId
);
```
to:
```typescript
const isOrgAdmin = await PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost(
  authUserId,
  bookingUserId
);
```

## Files to Fix
- apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts[894-897]

## Issue Description
The logic in PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost is inverted, causing it to return false for actual org admins.

## Context
This function checks if a logged-in user is an org admin of a booking host. It should return false only when the user has NO admin organizations, but currently returns false when they DO have admin organizations.

## Recommended Fix
File: packages/lib/server/repository/PrismaOrgMembershipRepository.ts[27-28]

Change line 27 from:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length > 0) {
```

To:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length === 0) {
```

This ensures the function only returns false when the user has no admin organizations, allowing the subsequent logic to check if the booking user belongs to those organizations.

## Issue Description
The authorization check in handleCancelBooking.ts has incorrect boolean logic that prevents org admins from canceling bookings.

## Context
The code should allow users who are hosts, owners, OR org admins to cancel bookings. Currently it throws an error when the user IS an org admin (and not a host/owner), which is backwards.

## Recommended Fix
File: packages/features/bookings/lib/handleCancelBooking.ts[156-161]

Change line 156 from:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && userIsOrgAdminOfBookingUser) {
```

To:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && !userIsOrgAdminOfBookingUser) {
```

This ensures the error is only thrown when the user is NONE of the authorized roles (not a host, not an owner, and not an org admin).

## Issue Description
Line 46 in `isLoggedInUserOrgAdminOfBookingHost` returns `true` when the booking user is NOT found as a member of the org, which grants unauthorized access.

## Context
This function should only return true if the booking user IS a member of an organization where the logged-in user is an admin. If no membership is found, authorization should be denied.

## Recommended Fix
Modify the file: `packages/lib/server/repository/PrismaOrgMembershipRepository.ts`

**Line 46**: Change from:
```typescript
if (!bookingUserOrgMembership) return true;
```

To:
```typescript
if (!bookingUserOrgMembership) return false;
```

This ensures authorization is denied when the booking user is not a member of any org where the logged-in user is an admin.

## Issue Description
The `isLoggedInUserOrgAdminOfBookingHost` method in `PrismaOrgMembershipRepository` has inverted logic that causes it to return `false` when org admin memberships ARE found, when it should return `false` when NO memberships are found.

## Context
This function is used to authorize org admins to manage bookings for users in their organization. The current logic breaks all authorization checks.

## Recommended Fix
Modify the file: `packages/lib/server/repository/PrismaOrgMembershipRepository.ts`

**Line 27**: Change the condition from:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length > 0) {
```

To:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length === 0) {
```

This ensures the function returns `false` early only when the logged-in user has NO org admin memberships, and continues to check if the booking user belongs to those orgs when memberships exist.

## Issue Description
The authorization check in `handleCancelBooking` has incorrect logic that blocks org admins instead of allowing them to cancel bookings.

## Context
The PR adds org admin authorization for canceling bookings. The condition should throw an error when the user is NOT a host AND NOT an owner AND NOT an org admin.

## Recommended Fix
Modify the file: `packages/features/bookings/lib/handleCancelBooking.ts`

**Line 155**: Change from:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && userIsOrgAdminOfBookingUser) {
```

To:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && !userIsOrgAdminOfBookingUser) {
```

Add the negation operator `!` before `userIsOrgAdminOfBookingUser` to correctly allow org admins to cancel bookings.

## Issue Description
The authorization check in `PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost` has inverted logic that prevents org admins from managing bookings.

## Context
The method should return true if the logged-in user is an org admin of the booking host's organization. Currently, it returns false when the user IS an admin (length > 0), which is backwards.

## Recommended Fix
File: packages/lib/server/repository/PrismaOrgMembershipRepository.ts[27-28]

Change line 27 from:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length > 0) {
```

To:
```typescript
if (orgIdsWhereLoggedInUserAdmin.length === 0) {
```

This ensures the method returns false only when the user is NOT an admin of any organizations.

## Issue Description
The authorization check in `handleCancelBooking.ts` incorrectly blocks org admins from canceling bookings instead of allowing them.

## Context
The PR adds functionality for org admins to cancel bookings for managed users. The authorization check should allow users who are hosts, owners, OR org admins. Currently, it throws an error when the user IS an org admin.

## Recommended Fix
File: packages/features/bookings/lib/handleCancelBooking.ts[156-161]

Change line 156 from:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && userIsOrgAdminOfBookingUser) {
```

To:
```typescript
if (!userIsHost && !userIsOwnerOfEventType && !userIsOrgAdminOfBookingUser) {
```

This ensures the error is thrown only when the user is NOT a host AND NOT an owner AND NOT an org admin, allowing org admins to proceed with cancellation.

### Issue description
`PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost` has inverted boolean logic:
- It returns `false` when `orgIdsWhereLoggedInUserAdmin.length > 0` (should only short-circuit to `false` when the list is empty).
- It returns `true` when no membership is found for the booking host in those orgs.
This can deny real org admins and (worse) treat non-admin users as org admins.

### Issue Context
This helper is used for authorization decisions in booking confirmation and seated booking reschedule/cancel flows.

### Fix Focus Areas
- packages/lib/server/repository/PrismaOrgMembershipRepository.ts[24-60]

### Recommended fix
1. Change the early return to:
   - `if (orgIdsWhereLoggedInUserAdmin.length === 0) return false;`
2. Change the membership checks to return `true` only when the booking user is found in either:
   - an org team with `team.parentId: null` whose `teamId` is in `orgIdsWhereLoggedInUserAdmin`, OR
   - a sub-team whose `team.parentId` is in `orgIdsWhereLoggedInUserAdmin`.
3. Ensure the function returns `false` when neither membership exists.

### Issue description
`PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost` is defined as `(loggedInUserId, bookingUserId)` but is called with reversed arguments in `BookingsService_2024_08_13`, leading to incorrect authorization decisions.

### Issue Context
This is used to determine whether a seated booking reschedule should be allowed for an org admin.

### Fix Focus Areas
- apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts[877-900]

### Recommended fix
Call:
```ts
await PrismaOrgMembershipRepository.isLoggedInUserOrgAdminOfBookingHost(authUserId, bookingUserId)
```
(not the reversed order).

### Issue description
`createRescheduleBookingRequest` uses:
```ts
!isIndividualSeatReschedule && "seatUid" in body
  ? transformInputRescheduleSeatedBooking(...)
  : transformInputRescheduleBooking(...)
```
This makes the seated transformer *unreachable* precisely when `seatUid` exists (the individual-seat case), which then drives seated requests into `transformInputRescheduleBooking` where they can throw the seated-booking error.

### Issue Context
`BookingsService_2024_08_13` sets the boolean to `true` when the body contains `seatUid`, so the negation breaks the intended branch.

### Fix Focus Areas
- apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts[507-517]
- apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts[611-632]
- apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts[760-779]

### Recommended fix
1. Select the transformer based primarily on the presence of `seatUid`:
   - if `"seatUid" in body` -> `transformInputRescheduleSeatedBooking`
   - else -> `transformInputRescheduleBooking`
2. If you need to support org-admin “all seats” reschedule, use a separate boolean (e.g. `isOrgAdminAllSeatsReschedule`) and apply it only to the seated-booking validation (not to transformer selection).