feat(auth): Return auth error if application is requesting a wrong org

[sentaur-athena]

If an application is organization scope application, their tokens will only have access to one organization of a user. So we should return auth error if:

1. They're calling an API on an organization that is not the same as the org in the token
2. They're calling an API that is not limited to one organization, for example list all user's project

In a previous PR I added some logging to make sure this doesn't break other integrations. It actually does, so I have to limit this to token.scoping_organization_id vs token.organization_id

[codecov]

Codecov Report

Attention: Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/sentry/api/authentication.py	80.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #81193   +/-   ##
=======================================
  Coverage   80.35%   80.35%           
=======================================
  Files        7221     7220    -1     
  Lines      319612   319588   -24     
  Branches    20783    20783           
=======================================
- Hits       256821   256802   -19     
+ Misses      62396    62391    -5     
  Partials      395      395           

[sentaur-athena]

It's safe to allowlist usage of this endpoint even though the endpoint is not specific to one organization because this case is already handled in the endpoint code: https://github.com/getsentry/sentry/blob/master/src/sentry/api/endpoints/organization_index.py#L98

So basically if I call this endpoint to list organizations of one person with a token that only has access to one of them the endpoint only returns that one.

I should add it's also important and required to allowlist this endpoint because for a partner who doesn't store any sentry data like organization id, this is the only way to get the organization id they want to query on.

[sentry-io]

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

• ‼️ OperationalError: OperationalError('server closed the connection unexpectedly\n\tThis probably means the server ter... /api/0/projects/{organization_id_or_slug}/{proj... View Issue

_{Did you find this useful? React with a 👍 or 👎}