fix: permission checks on session API

# Which Problems Are Solved

The session API allowed any authenticated user to update sessions by their ID without any further check.
This was unintentionally introduced with version 2.53.0 when the requirement of providing the latest session token on every session update was removed and no other permission check (e.g. session.write) was ensured.

# How the Problems Are Solved

- Granted `session.write` to `IAM_OWNER` and `IAM_LOGIN_CLIENT` in the defaults.yaml
- Granted `session.read` to `IAM_ORG_MANAGER`, `IAM_USER_MANAGER` and `ORG_OWNER` in the defaults.yaml
- Pass the session token to the UpdateSession command.
- Check for `session.write` permission on session creation and update.
  - Alternatively, the (latest) sessionToken can be used to update the session.
- Setting an auth request to failed on the OIDC Service `CreateCallback` endpoint now ensures it's either the same user as used to create the auth request (for backwards compatibilty) or requires `session.link` permission.
- Setting an device auth request to failed on the OIDC Service `AuthorizeOrDenyDeviceAuthorization` endpoint now requires `session.link` permission.
- Setting an auth request to failed on the SAML Service `CreateResponse` endpoint now requires `session.link` permission.

# Additional Changes

none

# Additional Context

none

(cherry picked from commit 4c942f3477)

internal/command/session.go

@@ -285,7 +285,13 @@ func (s *SessionCommands) commands(ctx context.Context) (string, []eventstore.Co
 	return token, s.eventCommands, nil
 }
 
-func (c *Commands) CreateSession(ctx context.Context, cmds []SessionCommand, metadata map[string][]byte, userAgent *domain.UserAgent, lifetime time.Duration) (set *SessionChanged, err error) {
+func (c *Commands) CreateSession(
+	ctx context.Context,
+	cmds []SessionCommand,
+	metadata map[string][]byte,
+	userAgent *domain.UserAgent,
+	lifetime time.Duration,
+) (set *SessionChanged, err error) {
 	sessionID, err := c.idGenerator.Next()
 	if err != nil {
 		return nil, err
@@ -295,17 +301,29 @@ func (c *Commands) CreateSession(ctx context.Context, cmds []SessionCommand, met
 	if err != nil {
 		return nil, err
 	}
+	if err = c.checkSessionWritePermission(ctx, sessionWriteModel, ""); err != nil {
+		return nil, err
+	}
 	cmd := c.NewSessionCommands(cmds, sessionWriteModel)
 	cmd.Start(ctx, userAgent)
 	return c.updateSession(ctx, cmd, metadata, lifetime)
 }
 
-func (c *Commands) UpdateSession(ctx context.Context, sessionID string, cmds []SessionCommand, metadata map[string][]byte, lifetime time.Duration) (set *SessionChanged, err error) {
+func (c *Commands) UpdateSession(
+	ctx context.Context,
+	sessionID, sessionToken string,
+	cmds []SessionCommand,
+	metadata map[string][]byte,
+	lifetime time.Duration,
+) (set *SessionChanged, err error) {
 	sessionWriteModel := NewSessionWriteModel(sessionID, authz.GetInstance(ctx).InstanceID())
 	err = c.eventstore.FilterToQueryReducer(ctx, sessionWriteModel)
 	if err != nil {
 		return nil, err
 	}
+	if err = c.checkSessionWritePermission(ctx, sessionWriteModel, sessionToken); err != nil {
+		return nil, err
+	}
 	cmd := c.NewSessionCommands(cmds, sessionWriteModel)
 	return c.updateSession(ctx, cmd, metadata, lifetime)
 }
@@ -380,6 +398,21 @@ func (c *Commands) updateSession(ctx context.Context, checks *SessionCommands, m
 	return changed, nil
 }
 
+// checkSessionWritePermission will check that the provided sessionToken is correct or
+// if empty, check that the caller is granted the "session.write" permission on the resource owner of the authenticated user.
+// In case the user is not set and the userResourceOwner is not set (also the case for the session creation),
+// it will check permission on the instance.
+func (c *Commands) checkSessionWritePermission(ctx context.Context, model *SessionWriteModel, sessionToken string) error {
+	if sessionToken != "" {
+		return c.sessionTokenVerifier(ctx, sessionToken, model.AggregateID, model.TokenID)
+	}
+	userResourceOwner, err := c.sessionUserResourceOwner(ctx, model)
+	if err != nil {
+		return err
+	}
+	return c.checkPermission(ctx, domain.PermissionSessionWrite, userResourceOwner, model.UserID)
+}
+
 // checkSessionTerminationPermission will check that the provided sessionToken is correct or
 // if empty, check that the caller is either terminating the own session or
 // is granted the "session.delete" permission on the resource owner of the authenticated user.