[Proposal] Limit the Visibility of Organization Quotas

Background

Currently, the GET /v3/organization_quotas endpoint lists all organization quotas present in a foundation. However, this can result in displaying quotas that may not be relevant to the authenticated user. The proposal aims to improve this by limiting the visibility of organization quotas to only those that have been assigned to organizations accessible by the user.

Proposed Change

The endpoint behavior should remain unchanged by default, showing all organization quotas. However, we suggest introducing a configuration option that allows administrators to control the visibility of organization quotas. The new behavior, enabled by the configuration option, would only display quotas that have been assigned to organizations the authenticated user can access.

Implementation Options

1. Config Property: We can introduce a configuration option as a property in the capi-release for the job cloud_controller_ng.
2. Feature Flag: Alternatively, we can implement the configuration option as a feature flag. This approach allows for easier toggling of the behavior without requiring a redeployment.

Benefits

By implementing this proposal, we can enhance the user experience by only displaying relevant organization quotas. Users will no longer see quotas that have not been assigned to organizations they can access, reducing confusion and improving the overall usability of the API.

This change is particularly useful as the assignment of quotas can only be done by administrators, and users without the necessary permissions would find little value in viewing all organization quotas.

Start by tracing the GET /v3/organization_quotas endpoint and how authenticated users' accessible organizations and quota assignments are determined. Compare the proposed capi-release cloud_controller_ng configuration property with the feature-flag option, then define tests showing that the default lists all quotas while the enabled behavior lists only quotas assigned to accessible organizations.