[Feature]: Developer should only see organizations they belong to when authenticating with a ClientCert

[gcapizzi]

Background

At the moment, GET /v3/organizations returns the full list of organizations present on the foundation. We should only return the organizations the user making the request belongs to, e.g. organizations the user has some role in.

We want to keep this behaviour behind a feature flag for now, to avoid having a mix of authenticated and unauthenticated endpoints exposed.

Acceptance Criteria

GIVEN a cf root namespace exists
AND the org1, org2 and org3 subnamespaces of cf exist
AND user has RoleBindings (to any role for now) in org1 and org3
AND a token issued to user exists
WHEN user performs a GET /v3/organizations including the Authorization: ClientCert <the-client-cert-and-key> header
THEN they only see org1 and org3 in the resources field

GIVEN a cf root namespace exists
AND the org1, org2 and org3 subnamespaces of cf exist
AND user has RoleBindings (to any role for now) in org1 and org3
WHEN user performs a GET /v3/organizations without the Authorization header
THEN they get a 401 Unauthorized response with a NotAuthenticated error message

Dev Notes

• Possible formats for the header:
  • Authorization: ClientCert XXX/YYY
  • Authorization: ClientCert XXX ClientKey YYY