add OIDC integration check on access policy check

Author: XiNiHa

packages/services/api/src/modules/auth/lib/supertokens-strategy.ts

@@ -63,7 +63,12 @@ export class SuperTokensCookieBasedSession extends Session {
       user.id,
       organizationId,
     );
-    const organization = await this.storage.getOrganization({ organizationId });
+    const [organization, oidcIntegration] = await Promise.all([
+      this.storage.getOrganization({ organizationId }),
+      this.storage.getOIDCIntegrationForOrganization({
+        organizationId,
+      }),
+    ]);
     const organizationMembership = await this.organizationMembers.findOrganizationMembership({
       organization,
       userId: user.id,
@@ -108,6 +113,10 @@ export class SuperTokensCookieBasedSession extends Session {
       ];
     }
 
+    if (oidcIntegration?.oidcUserAccessOnly && this.oidcIntegrationId !== oidcIntegration.id) {
+      return [];
+    }
+
     this.logger.debug(
       'Translate organization role assignments to policy statements. (userId=%s, organizationId=%s)',
       user.id,