✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Greptile Overview

Greptile Summary

Removed the if (req.auth.actor !== ActorType.USER) return; early-exit check from the organization members list endpoint (/:organizationId/memberships) to allow machine identities to query organization members. Refactored the findAllOrgMembers service function signature from positional parameters to an object-based parameter using the TFindAllOrgMembersDTO type (which extends TOrgPermission), making it consistent with similar endpoints like findAllWorkspaces.

Key changes:

• Router now passes req.permission.type as the actor field instead of hardcoding ActorType.USER
• Permission checks in the service layer properly validate that the requesting identity has OrgPermissionActions.Read permission for OrgPermissionSubjects.Member
• The endpoint already had AuthMode.IDENTITY_ACCESS_TOKEN in its auth modes but was blocked at the handler level

Analysis:
The permission system properly restricts access - machine identities must have the appropriate Read permission on the Member subject to access this endpoint. This is consistent with the pattern used in the /:organizationId/workspaces endpoint which already allows identities. The data returned includes user information (emails, names, roles) which may be sensitive, but access is properly gated by the RBAC permission system.

Confidence Score: 4/5

• This PR is safe to merge with low risk, assuming proper identity permission configuration
• The change properly extends identity access to the org members list endpoint while maintaining existing permission checks. The permission validation (OrgPermissionActions.Read on OrgPermissionSubjects.Member) ensures only authorized identities can access member data. The pattern is consistent with the workspaces endpoint. Minor concern: organization member data (emails, names, roles) is potentially sensitive, so teams should ensure machine identities are granted appropriate minimal permissions.
• No files require special attention - the changes are straightforward and properly validated

Important Files Changed