fix(public-dashboard): Improve ensurePublicContext in public-dashboards (#17533)

[SarahBocognano]

Proposed changes

• check if userInside of organization

Related issues

• closes: fix(public-dashboard): Improve ensurePublicContext in public-dashboards #17533

How to test this PR

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant use cases (coverage and e2e)
• I added/updated the relevant documentation (either on GitHub or on Notion)
• Where necessary, I refactored code to improve the overall quality

Further comments

[Copilot]

Pull request overview

This PR updates the opencti-graphql public dashboard widget execution context to compute user_inside_platform_organization based on the dashboard creator’s organization membership and platform settings, instead of forcing it to true.

Changes:

• Fetches platform settings (ENTITY_TYPE_SETTINGS) in ensurePublicContext.
• Computes context.user_inside_platform_organization using isUserInPlatformOrganization(user, settings) for public dashboard widget queries.

Suppressed comments (1)

opencti-platform/opencti-graphql/src/modules/publicDashboard/publicDashboard-domain.ts:335

• This change alters authorization behavior for public dashboard widget queries by recomputing user_inside_platform_organization from settings + user orgs, but there is no test asserting the behavior for a user outside the platform organization (e.g., platform org configured and dashboard creator not a member). Adding an integration test around a public dashboard query would prevent regressions.

  const settings = await getEntityFromCache<BasicStoreSettings>(context, SYSTEM_USER, ENTITY_TYPE_SETTINGS);
  context.user_inside_platform_organization = isUserInPlatformOrganization(user, settings);

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.01%. Comparing base (f73357b) to head (7b36127).
⚠️ Report is 21 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #17534      +/-   ##
==========================================
+ Coverage   34.11%   35.01%   +0.90%     
==========================================
  Files        3376     3387      +11     
  Lines      137662   141265    +3603     
  Branches    37258    38889    +1631     
==========================================
+ Hits        46963    49469    +2506     
- Misses      90699    91796    +1097     

Flag	Coverage Δ
opencti-client-python	48.37% <ø> (ø)
opencti-front	11.12% <ø> (+0.04%)	⬆️
opencti-graphql	70.20% <100.00%> (+1.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gabrielebonadiman]

One small question on this test update: since the mock returns platform_organization: null , isUserInPlatformOrganization  would return  true  regardless of the user's org membership.. just mentioning it because this test would pass even without the fix. Would it be possible to add a case with platform_organization  set and a user who isn't a member, to confirm user_inside_platform_organization  resolves to  false ?

[SarahBocognano]

I have added a dedicated unit test for isUserInPlatformOrganization covering a non-member user with platform_organization set, which resolves to false as expected. Kept it in a separate file since the distribution tests go through ensurePublicContext, which hardcodes the flag and can't exercise that logic anyway.