Aggressively check RBAC when Application request is fully-parameterized

[crenshaw-dev]

Summary

GHSA-2q5c-qw9c-fmvq introduced a breaking API change. If an app does not exist, the API always returns a 403.

We can be a bit smarter than that. If the user provides the app name and the project name, we should aggressively perform an RBAC check. If they pass the RBAC check, and the app does not exist, we return a 404. This allows the user to determine the non-existence of the app without calling the can-i API.

However, this changes API behavior for users who send the app name and an incorrect project name, when they do not have access to the given app under the given project. Currently, if a user passes a correct name but an incorrect project name, the API "auto-corrects" the project name to the one actually existing on the application. After this change, we'll reject their request based on the given project name and ignore the actual project name.

Motivation

Intuit has a user who wants to know for certain whether an app exists without making an extra API call to the can-i endpoint. Right now, 403 could mean "the app doesn't exist" or "your token is expired." Since our user knows the app's project name, they can send both the app and project name on their request. Since the request is fully parameterized (with respect to the RBAC check) we can safely determine that they have access and tell them whether the app exists.

[crenshaw-dev]

This would mitigate the problems described in #13000

[alv91]

Hello, any update on this issue? :)

[crenshaw-dev]

@alv91 I'm going to push the PR forward, but it's not my top priority at the moment. Next ~2 weeks, I should pick it up.