fix(rls): not handling global permissions

src/authorization.sql

@@ -245,6 +245,12 @@ BEGIN
 
     v_computed_result := morbac.is_allowed_nocache(p_user_id, p_org_id, p_activity, p_view);
 
+    -- NULL org_id (global-rules-only path) cannot be stored in auth_cache (org_id NOT NULL PK).
+    -- Global rule changes flush the entire cache anyway, so skipping is safe.
+    IF p_org_id IS NULL THEN
+        RETURN v_computed_result;
+    END IF;
+
     BEGIN
         INSERT INTO morbac.auth_cache (user_id, org_id, activity, view, allowed, expires_at)
         VALUES (

src/rls.sql

@@ -162,17 +162,15 @@ BEGIN
     v_org_ids := morbac.current_org_ids();
 
     IF v_org_ids IS NOT NULL THEN
-        IF p_row_org_id IS NULL OR NOT (p_row_org_id = ANY(v_org_ids)) THEN
+        IF p_row_org_id IS NOT NULL AND NOT (p_row_org_id = ANY(v_org_ids)) THEN
             RETURN FALSE;
         END IF;
+        -- p_row_org_id NULL: global row — is_allowed(NULL) checks global_rules only
         RETURN morbac.is_allowed(v_user_id, p_row_org_id, p_activity, p_view);
     END IF;
 
-    IF p_row_org_id IS NOT NULL THEN
-        RETURN morbac.is_allowed(v_user_id, p_row_org_id, p_activity, p_view);
-    END IF;
-
-    RETURN FALSE;
+    -- No org context: use row's org (or NULL for global rows — global_rules only)
+    RETURN morbac.is_allowed(v_user_id, p_row_org_id, p_activity, p_view);
 END;
 $$;