fix: get bookings handler for pbac and fallback roles

[tomerqodo]

Benchmark PR from qodo-benchmark#666

---

Note

Strengthens access control and scopes results using PBAC and fallback roles.

• Viewer bookings handler now derives accessible teams via PermissionCheckService.getTeamIdsWithPermission using booking.read + fallback roles (ADMIN, OWNER) and optional orgId, replacing manual admin/owner filters
• Uses these team IDs to compute accessible users/emails and event types; rejects filters.userIds outside accessible scope with FORBIDDEN
• PermissionRepository adds optional orgId to getTeamIdsWithPermission(s); splits logic into getTeamsWithPBACPermissions and getTeamsWithFallbackRoles, adds org-aware SQL filters, and de-dupes results
• PermissionCheckService exposes org-scoped getTeamIdsWithPermission(s) forwarding to repository
• Tests: new unit tests for bookings handler PBAC flows; integration tests validating orgId scoping and child team inclusion in permission queries

^{Written by Cursor Bugbot for commit 07d6cf4. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

orgId parameter not passed to delegated method

High Severity

The getTeamIdsWithPermission method receives orgId as a parameter but does not pass it to getTeamIdsWithPermissions. This causes the orgId filtering to be silently ignored when using the singular permission method, meaning teams from all organizations may be returned instead of only teams within the specified organization.

 

[cursor]

Authorization bypass by including own user ID

High Severity

The change from filters.userIds.length === 1 && user.id === filters.userIds[0] to filters.userIds.includes(user.id) allows authorization bypass. A user can now include unauthorized user IDs in the filter by also including their own ID, causing isCurrentUser to be true and bypassing the FORBIDDEN check at line 154, while the query at line 170 still fetches bookings for all specified users including unauthorized ones.