fix(organization): reject updating an org other than the authenticated one

[Tyagiquamar]

Problem

ORGANIZATION_UPDATE takes id as the org to update but never checked it against ctx.organization?.id (the path-resolved, membership-verified org). A caller authenticated against org A could pass input.id for org B and reach boundAuth.organization.update with an org they may have zero membership in. As with ORGANIZATION_DELETE before #6501, Better Auth's own updateOrganization re-checks permission for the target org, so this is not a live bypass today — but it left the tool one vendored-dependency behavior away from one, and it was the last sibling in the directory without the guard (member-add.ts, member-remove.ts, delete.ts all have it).

Fix

The same defense-in-depth guard used in member-remove.ts/delete.ts: reject when input.id !== ctx.organization?.id.

Testing

• bun test apps/api/src/tools/organization/update.test.ts apps/api/src/tools/organization/delete.test.ts → 6 pass, 0 fail (new case: updating a different org rejects and never reaches boundAuth; existing cases updated for the now-present ctx.organization).
• bun run --cwd=apps/api check → exit 0.
• bunx biome check on touched files → clean.

---

Summary by cubic

Rejects updating an organization other than the authenticated one in ORGANIZATION_UPDATE. Previously it accepted any id and relied on downstream checks; now it throws when input.id !== ctx.organization.id, preventing cross-org updates and surfacing an earlier error if a client passes a mismatched id.

• Stops execution before calling boundAuth.organization.update when the target org differs from the authenticated org.
• Adds a test covering cross-org rejection and sets ctx.organization in update tests.

^{Written for commit 895fd1a. Summary will update on new commits.}

[viktormarinho]

@Tyagiquamar instead of checking id, I would drop it from the input schema entirely and take the org from requireOrganization(ctx). It is already resolved from the URL path, so the param can only ever carry the value the server knows, and then there is nothing left to compare. Nothing in the repo passes it today (the settings UI calls the Better Auth client directly) and tools-rest.ts parses with a non-strict z.object, so any agent still sending id keeps working and just gets it stripped. delete.ts has the same redundant id.