feat: give full access to ocf admin

[PavanRaghavendraKulkarni]

Pull Request

Description

This pull request updates the authentication middleware to bypass organization-based filtering when the authenticated user has OCF Admin privileges (ocf:admin permission).

Previously, all site-related queries were filtered by the user's HubSpot company ID (organisation_id_filter), preventing OCF admins from viewing or managing sites across multiple organizations. With this change, get_org_id_from_authdata returns None for admin users, enabling unfiltered access to all locations.

Key Changes

1. Middleware Update: Added an admin check in get_org_id_from_authdata (in src/quartz_api/internal/middleware/auth.py).
2. Unit Tests: Created a new test file src/quartz_api/internal/middleware/test_auth.py to cover:
   • Extraction of HubSpot company ID for regular users.
   • Bypassing the company ID and returning None for admin users.
   • Handling tokens without metadata.

PR

How Has This Been Tested?

• Run locally using uv run pytest src/quartz_api/internal/middleware/test_auth.py (all tests passed).

• Verified manually using curl request testing.

• Yes

Checklist:

• My code follows OCF's coding style guidelines
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I have checked my code and corrected any misspellings