chore(rbac): Allow OrgViewers to see organization memberships (#2280)

Signed-off-by: Jose I. Paris <[email protected]>

Author: jiparis

app/controlplane/internal/service/group.go

@@ -236,8 +236,14 @@ func (g *GroupService) ListMembers(ctx context.Context, req *pb.GroupServiceList
 		return nil, err
 	}
 
-	if err := g.userHasPermissionToListGroupMember(ctx, currentOrg.ID, req.GetGroupReference()); err != nil {
-		return nil, err
+	orgRole := usercontext.CurrentAuthzSubject(ctx)
+
+	// Viewers can see group memberships
+	// TODO: replace this with enforcer check once group_memberships and memberships are merged
+	if authz.Role(orgRole) != authz.RoleViewer {
+		if err := g.userHasPermissionToListGroupMember(ctx, currentOrg.ID, req.GetGroupReference()); err != nil {
+			return nil, err
+		}
 	}
 
 	currentUser, err := requireCurrentUser(ctx)

app/controlplane/pkg/authz/authz.go

@@ -158,8 +158,10 @@ var (
 	PolicyWorkflowDelete = &Policy{ResourceWorkflow, ActionDelete}
 	// Projects
 	PolicyProjectCreate = &Policy{ResourceProject, ActionCreate}
+
 	// User Membership
-	PolicyOrganizationRead = &Policy{Organization, ActionRead}
+	PolicyOrganizationRead            = &Policy{Organization, ActionRead}
+	PolicyOrganizationListMemberships = &Policy{OrganizationMemberships, ActionList}
 
 	// Group Memberships
 	PolicyGroupListPendingInvitations = &Policy{ResourceGroup, ActionList}
@@ -215,6 +217,9 @@ var RolesMap = map[Role][]*Policy{
 		PolicyWorkflowRead,
 		// Organization
 		PolicyOrganizationRead,
+
+		// List organization memberships
+		PolicyOrganizationListMemberships,
 	},
 	// RoleAdmin is an org-scoped role that provides super admin privileges (it's the higher role)
 	RoleAdmin: {
@@ -385,6 +390,10 @@ var ServerOperationsMap = map[string][]*Policy{
 	// since all the permissions here are in the context of an organization
 	// Create new organization
 	"/controlplane.v1.OrganizationService/Create": {},
+
+	// List global memberships
+	"/controlplane.v1.OrganizationService/ListMemberships": {PolicyOrganizationListMemberships},
+
 	// NOTE: this is about listing my own memberships, not about listing all the memberships in the organization
 	"/controlplane.v1.UserService/ListMemberships": {},
 	// Set the current organization for the current user