[PM-40350] ManagePolicies should allow read-only access to claimed organization domains

[harr1424]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-40350

📔 Objective

This PR modifies policy gated logic to allow users having the ManagePolicies role to access a read-only endpoint and enumerate claimed domains for organizations they belong to and have been granted this role on behalf of.

This is necessary so that the Send Policy edit dialog populates domains claimed by an organization, and is a proper fix compared to the previous bandaid.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the authorization change to GetAll on OrganizationDomainController, which now permits either ManageSso or ManagePolicies for this read-only endpoint, plus the accompanying unit test. Permission checks still precede the organization existence lookup, so the endpoint does not leak org existence to unauthorized callers, and ManagePolicies resolves through the same OrganizationAdmin OR custom-permission path used by ManageSso. The response exposes only organization-scoped domain claim data (domain name, DNS TXT verification value, verification timestamps) to a role already scoped to that organization, so no zero-knowledge or vault-data boundary is affected. Write paths (Post, Verify, RemoveDomain) remain gated on ManageSso via ValidateOrganizationAccessAsync, and the existing negative test still passes since the unconfigured ManagePolicies substitute returns false.

Code Review Details

No findings at or above the reporting threshold. Minor observation not worth an inline comment: the new inline check duplicates the organization existence lookup already in ValidateOrganizationAccessAsync, which could be parameterized if more endpoints need mixed permissions.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.27%. Comparing base (c93bbb7) to head (c63f029).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8220   +/-   ##
=======================================
  Coverage   63.27%   63.27%           
=======================================
  Files        2383     2383           
  Lines      103919   103925    +6     
  Branches     9408     9410    +2     
=======================================
+ Hits        65753    65759    +6     
  Misses      35916    35916           
  Partials     2250     2250           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.