fix(data-access): return plain camelCase object from allByOrganizationIds*WithTargetOrganization

#fetchGrantsWithTargetOrg was calling createInstanceFromRow(), producing a
model instance for the `grant` field. The auth-service (and the method's own
docstring) expected a plain camelCase object with direct property access
(grant.productCode, grant.expiresAt, grant.organizationId, …). On a model
instance those fields are undefined; only getters like getProductCode() exist.

This caused the delegated_tenants loop to skip every grant because
`grant.productCode !== productCode` was always `undefined !== 'LLMO'` → true,
leaving delegated_tenants: [] in every JWT regardless of real DB grants.

Fix: destructure the embedded `organizations` key from the PostgREST row,
then call fromDbRecord(grantRow, this.fieldMaps.toModelMap) to produce the
documented plain camelCase object.

Update unit and IT tests to assert direct property access (grant.organizationId,
grant.productCode, …) instead of model-instance getters, so the contract is
verified at the test level going forward.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ekremney

packages/spacecat-shared-data-access/src/models/site-ims-org-access/site-ims-org-access.collection.js

@@ -12,7 +12,7 @@
 
 import BaseCollection from '../base/base.collection.js';
 import DataAccessError from '../../errors/data-access.error.js';
-import { DEFAULT_PAGE_SIZE } from '../../util/postgrest.utils.js';
+import { DEFAULT_PAGE_SIZE, fromDbRecord } from '../../util/postgrest.utils.js';
 
 /**
  * SiteImsOrgAccessCollection - Collection of cross-org delegation grants.
@@ -127,10 +127,13 @@ class SiteImsOrgAccessCollection extends BaseCollection {
   async #fetchGrantsWithTargetOrg(query) {
     return this.#fetchPaginatedGrants(
       query,
-      (row) => ({
-        grant: this.createInstanceFromRow(row),
-        targetOrganization: { id: row.organizations.id, imsOrgId: row.organizations.ims_org_id },
-      }),
+      (row) => {
+        const { organizations, ...grantRow } = row;
+        return {
+          grant: fromDbRecord(grantRow, this.fieldMaps.toModelMap),
+          targetOrganization: { id: organizations.id, imsOrgId: organizations.ims_org_id },
+        };
+      },
       'Failed to query grants with target organization',
     );
   }

packages/spacecat-shared-data-access/test/it/site-ims-org-access/site-ims-org-access.test.js

@@ -165,8 +165,9 @@ describe('SiteImsOrgAccess IT', async () => {
     for (const entry of entries) {
       expect(entry).to.have.property('grant');
       expect(entry).to.have.property('targetOrganization');
-      expect(entry.grant.getOrganizationId()).to.equal(organizationId);
-      expect(entry.targetOrganization.id).to.equal(entry.grant.getTargetOrganizationId());
+      // grant is a plain camelCase object — use direct property access, not model getters
+      expect(entry.grant.organizationId).to.equal(organizationId);
+      expect(entry.targetOrganization.id).to.equal(entry.grant.targetOrganizationId);
     }
   });
 
@@ -183,9 +184,10 @@ describe('SiteImsOrgAccess IT', async () => {
     for (const entry of entries) {
       expect(entry).to.have.property('grant');
       expect(entry).to.have.property('targetOrganization');
-      expect(entry.grant.getOrganizationId()).to.equal(organizationId);
-      expect(entry.grant.getTargetOrganizationId()).to.be.a('string');
-      expect(entry.targetOrganization.id).to.equal(entry.grant.getTargetOrganizationId());
+      // grant is a plain camelCase object — use direct property access, not model getters
+      expect(entry.grant.organizationId).to.equal(organizationId);
+      expect(entry.grant.targetOrganizationId).to.be.a('string');
+      expect(entry.targetOrganization.id).to.equal(entry.grant.targetOrganizationId);
       expect(entry.targetOrganization.imsOrgId).to.be.a('string');
     }
   });

packages/spacecat-shared-data-access/test/unit/models/site-ims-org-access/site-ims-org-access.collection.test.js

@@ -231,14 +231,17 @@ describe('SiteImsOrgAccessCollection', () => {
       expect(eqStub).to.have.been.calledWith('organization_id', mockRecord.organizationId);
       expect(orderStub).to.have.been.calledWith('id');
       const { grant, targetOrganization } = results[0];
-      expect(grant.getId()).to.equal('grant-1');
-      expect(grant.getSiteId()).to.equal('site-uuid-1');
-      expect(grant.getOrganizationId()).to.equal(mockRecord.organizationId);
-      expect(grant.getTargetOrganizationId()).to.equal(mockRecord.targetOrganizationId);
-      expect(grant.getProductCode()).to.equal('LLMO');
-      expect(grant.getRole()).to.equal('agency');
-      expect(grant.getGrantedBy()).to.equal('ims:user123');
-      expect(grant.getExpiresAt()).to.be.undefined;
+      // grant is a plain camelCase object (not a model instance) — use direct property access.
+      // The primary key maps to the model's idName (siteImsOrgAccessId), not 'id'.
+      // null DB values are excluded by normalizeModelValue (expiresAt is absent, not null).
+      expect(grant.siteImsOrgAccessId).to.equal('grant-1');
+      expect(grant.siteId).to.equal('site-uuid-1');
+      expect(grant.organizationId).to.equal(mockRecord.organizationId);
+      expect(grant.targetOrganizationId).to.equal(mockRecord.targetOrganizationId);
+      expect(grant.productCode).to.equal('LLMO');
+      expect(grant.role).to.equal('agency');
+      expect(grant.grantedBy).to.equal('ims:user123');
+      expect(grant.expiresAt).to.be.undefined;
       expect(targetOrganization).to.deep.equal({
         id: mockRecord.targetOrganizationId,
         imsOrgId: 'target@AdobeOrg',
@@ -356,7 +359,7 @@ describe('SiteImsOrgAccessCollection', () => {
 
       expect(results).to.have.lengthOf(1);
       expect(inStub).to.have.been.calledWith('organization_id', ids);
-      expect(results[0].grant.getOrganizationId()).to.equal(mockRecord.organizationId);
+      expect(results[0].grant.organizationId).to.equal(mockRecord.organizationId);
       expect(results[0].targetOrganization.imsOrgId).to.equal('target@AdobeOrg');
     });