feat: enable company-wide order viewing and editing

shop/lib/actions/orders.ts

@@ -508,9 +508,21 @@ export async function updateOrder(
     .single()
 
   const isAdmin = dbUser?.role === 'admin'
-  const isOwner = existingOrder.user_id === user.id
+  let isAuthorized = existingOrder.user_id === user.id
 
-  if (!isAdmin && !isOwner) {
+  if (!isAuthorized && dbUser?.company_id && existingOrder.user_id) {
+    const { data: creatorUser } = await admin
+      .from('users')
+      .select('company_id')
+      .eq('id', existingOrder.user_id)
+      .single()
+
+    if (creatorUser?.company_id === dbUser.company_id) {
+      isAuthorized = true
+    }
+  }
+
+  if (!isAdmin && !isAuthorized) {
     throw new Error('Keine Berechtigung dieses Anfrage zu bearbeiten.')
   }