Move authorization checks from Organizations GQL Types to Resolvers

Context: https://gitlab.slack.com/archives/C6MLS3XEU/p1758714656710469

Remove the :read_organization checks from the Types::Organizations::OrganizationType

Instead, we should do the authorization checks in the finders, namely:

  • app/finders/organizations/organizations_finder.rb
  • app/finders/organizations/user_organizations_finder.rb

The current implementation causes the API to have inaccurate count field and produce N+1 queries.

image

Implementation Guide

  1. Remove authorize :read_organization from app/graphql/types/organizations/organization_type.rb`
  2. Update Organizations::OrganizationsFinder to only return organizations that the current_user can access.
    • Anonymous users: No organization.
    • Regular users: Organizations where they are a member of.
    • Administrators: All organizations.
Edited by Shane Maglangit