[PR 6] Add organization data access permissions for Custom Roles (#7964)

* Add Custom Roles organization data access

* Let direct collection assignments override groups on import

src/auth.rs

@@ -847,7 +847,6 @@ impl<'r> FromRequest<'r> for OrgHeaders {
 }
 
 pub struct AdminHeaders {
-    pub host: String,
     pub device: Device,
     pub user: User,
     pub membership_type: MembershipType,
@@ -869,7 +868,6 @@ impl<'r> FromRequest<'r> for AdminHeaders {
         let headers = try_outcome!(OrgHeaders::from_request(request).await);
         if headers.is_confirmed_and_admin() {
             Outcome::Success(Self {
-                host: headers.host,
                 device: headers.device,
                 user: headers.user,
                 membership_type: headers.membership_type,
@@ -889,6 +887,7 @@ macro_rules! permission_headers {
         $(#[$doc])*
         #[allow(dead_code, reason = "Not every route reads every field")]
         pub struct $name {
+            pub host: String,
             pub device: Device,
             pub user: User,
             pub membership_type: MembershipType,
@@ -905,6 +904,7 @@ macro_rules! permission_headers {
                 let headers = try_outcome!(OrgHeaders::from_request(request).await);
                 if headers.is_confirmed_and_admin() || headers.membership.has_custom_permission($permission) {
                     Outcome::Success(Self {
+                        host: headers.host,
                         device: headers.device,
                         user: headers.user,
                         membership_type: headers.membership_type,
@@ -937,6 +937,16 @@ permission_headers!(
     ManageGroupsHeaders,
     CustomPermission::ManageGroups
 );
+permission_headers!(
+    /// For the routes that read the event logs of an organization.
+    AccessEventLogsHeaders,
+    CustomPermission::AccessEventLogs
+);
+permission_headers!(
+    /// For the routes that export the vault of an organization.
+    AccessImportExportHeaders,
+    CustomPermission::AccessImportExport
+);
 
 // col_id is usually the fourth path param ("/organizations/<org_id>/collections/<col_id>"),
 // but there could be cases where it is a query value.