return Forbidden for organization missmatch (#1193)

* return Forbidden for organization missmatch

* check updates to incorporate with api calls without org

Author: muhammad-ali-e

backend/account_v2/custom_auth_middleware.py

@@ -38,11 +38,13 @@ def __call__(self, request: HttpRequest) -> HttpResponse:
         is_authenticated = auth_service.is_authenticated(request)
 
         if is_authenticated:
+            organization_id = UserSessionUtils.get_organization_id(request=request)
+            if request.organization_id and not organization_id:
+                return JsonResponse(
+                    {"message": "Organization access denied"}, status=403
+                )
             StateStore.set(Common.LOG_EVENTS_ID, request.session.session_key)
-            StateStore.set(
-                Account.ORGANIZATION_ID,
-                UserSessionUtils.get_organization_id(request=request),
-            )
+            StateStore.set(Account.ORGANIZATION_ID, organization_id)
             response = self.get_response(request)
             StateStore.clear(Account.ORGANIZATION_ID)
             StateStore.clear(Common.LOG_EVENTS_ID)