# Which Problems Are Solved
- Organization scopes not being enforced in device authorization flow
- No check whether orgs exist in an authorization request
# How the Problems Are Solved
- Logic to get ID/Domain of an organisation is moved to the `Request` interface.
- Added assertion for the org ID/Domain when creating the authorization request.
- Added checks when authorizing the auth / device request with a session to check if a specific organization is enforced.
- Added checks to prevent using a session of a user from another organization if enforces by scope
# Additional Changes
# Additional Context
- Related Issue: #11160
---------
Co-authored-by: Livio Spring <livio@zitadel.com>
Co-authored-by: Max Peintner <peintnerm@gmail.com>
(cherry picked from commit c3a6bdb0bb)
d90285929c