fix: lists decide every org through the permission system; no system-org shortcut

src/routes/rule-cross-org.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from 'fastify';
 import type { Pool } from 'pg';
-import { getUser, getOrgScope, orgScopeExpr, hasPermission, permittedScope, isActivityViewBound, SYSTEM_ORG_ID } from '../permissions.js';
+import { getUser, getOrgScope, listScope, hasPermission, permittedScope, isActivityViewBound, SYSTEM_ORG_ID } from '../permissions.js';
 import { crossOrgRuleResponse, notFound, forbidden, unauthorized, badRequest } from '../schemas.js';
 
 export function createCrossOrgRuleRoutes(db: Pool) {
@@ -26,12 +26,8 @@ export function createCrossOrgRuleRoutes(db: Pool) {
             const scope = await permittedScope(db, req, reply, orgIds, 'read', 'cross_org_rules');
             if (!scope) return reply;
 
-            const { expr: srcExpr, params: srcParams } = orgScopeExpr(scope, 'cor.source_org_id');
-            const { expr: tgtExpr, params: tgtParams } = orgScopeExpr(scope, 'cor.target_org_id', srcParams.length);
-            const where = srcExpr && tgtExpr ? `WHERE (${srcExpr} OR ${tgtExpr})`
-                        : srcExpr ? `WHERE ${srcExpr}`
-                        : tgtExpr ? `WHERE ${tgtExpr}`
-                        : '';
+            const { params } = await listScope(db, req, scope, 'read', 'cross_org_rules', 'cor.source_org_id');
+            const where = 'WHERE cor.source_org_id = ANY($1::UUID[]) OR cor.target_org_id = ANY($1::UUID[])';
 
             const { rows } = await db.query(
                 `SELECT cor.id,
@@ -46,7 +42,7 @@ export function createCrossOrgRuleRoutes(db: Pool) {
                  JOIN morbac.orgs  "to" ON "to".id = cor.target_org_id
                  ${where}
                  ORDER BY so.name, sr.name, "to".name, cor.activity, cor.view`,
-                [...srcParams, ...tgtParams],
+                params,
             );
             return rows;
         });