Remove unnecessary MANAGE_ORGANIZATIONS check

[dlpzx]

Feature or Bugfix

• Bugfix

Detail

• Remove unnecessary permission check in list environments in the organization

Relates

• environment admin teams cannot see organizations they created #842

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

• Does this PR introduce or modify any input fields or queries - this includes
  fetching data from storage outside the application (e.g. a database, an S3 bucket)?
  • Is the input sanitized?
  • What precautions are you taking before deserializing the data you consume?
  • Is injection prevented by parametrizing queries?
  • Have you ensured no eval or similar functions are used?
• Does this PR introduce any functionality or component that requires authorization?
  • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  • Are you logging failed auth attempts?
• Are you using or adding any cryptographic features?
  • Do you use a standard proven implementations?
  • Are the used keys controlled by the customer? Where are they stored?
• Are you introducing any new policies/roles/users?
  • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[noah-paige]

Tested in AWS that a user (UserA) in a group with no MANAGE_ORGANIZATIONS tenant permission is able to see environments tab for the organization they are apart of. A couple of considerations,

1. UserA can see ALL environments that are linked to the organization (not just the ones they created as env Admins)

• do we want to filter to only show the environments that a user in envAdmin for?
• we would also have to keep a query that shows all environments linked to an org (i.e. the creator of the organization should be able to see all environments linked to their org)

2. UserA can not view any of the teams that are a part of the organization since we still include @has_tenant_permission(permissions.MANAGE_ORGANIZATIONS) checks on listing the organization groups. I think this is okay but wanted to call it out if the intention is to allow GETS/reads on the organization information without the need for MANAGE_ORGANIZATIONS tenant permission

[dlpzx]

1. In my opinion if you are part of the Organization it is good to see which other environments belong to it. Seeing it from a user perspective, it can lead to collaboration between teams working in separate environments. Something like "we are aware that the X department has linked their account to data.all"
2. Very similar, seeing other teams in your organization increases the visibility of teams across the enterprise. I think we should change it. What do you think?

[noah-paige]

1. In my opinion if you are part of the Organization it is good to see which other environments belong to it. Seeing it from a user perspective, it can lead to collaboration between teams working in separate environments. Something like "we are aware that the X department has linked their account to data.all"

   2. Very similar, seeing other teams in your organization increases the visibility of teams across the enterprise. I think we should change it. What do you think?

@dlpzx I do not see any major issues with a team that is part of an organization being able to see what other environments or teams are a part of the larger organization (obviously while ensuring no permissions allowing any other create, update, delete actions on teams/envs they are not a part of)

I think following the same structure with Org-Teams the way we are fixing now for Org-Environments tab make sense, but @zsaltys what are your thoughts on this? Do you see any risks here?

[dlpzx]

Hi @noah-paige I have made the changes and added a clean-up of an unused method

[noah-paige]

Hi @noah-paige I have made the changes and added a clean-up of an unused method

@dlpzx - have you pushed the changes? I only see the 1 line changed still

[fourtyplustwo]

@noah-paige @dlpzx

1. If you are part of an env admin team and you're invited into an organization then the other reasonable option would to see only environments which you created or your team is invited to. However seeing all environments is also OK and I do see value in being able to see which other environments are linked in your organization. The change is OK.

2. I think same answer as above. One reasonable option would be to see only teams you are part of and the other is to see all of them if you're part of the organization. To see all teams is OK.

Overall I think these changes are an improvement over previous behavior and we can improve it further if needed.