Fix: unnecessary permission check in resolve_stack functions (failure in list datasets when there are shared datasets)

[dlpzx]

Feature or Bugfix

• Bugfix

Detail

The function get_stack_with_cfn_resources from StackService is used to resolve the CFN stack details of several stacks in data.all. It is a private function that is not used directly as resolver by any GraphQL query/mutation, so the permissions are checked indirectly by applying the permissions in the main API. Better with an example:

API Query: GetNotebook (what we want)

• 1. calls the service get_notebook decorated to check user GET_NOTEBOOK permissions on that Notebook1
• 2. calls get_stack_with_cfn_resources to resolve CFN details of the Notebook

API Query: GetNotebook (what we currently have)

• 1. calls the service get_notebook decorated to check user GET_NOTEBOOK permissions on that Notebook1
• 2. calls get_stack_with_cfn_resources
• 3. inside get_stack_with_cfn_resources we call find_environment, which checks the GET_ENVIRONMENT permissions of the user

In this PR I revert to pass the environmentUri instead of passing the environment. Instead of using the EnvironmentService, it uses the EnvironmentRepository

Relates

• https://github.com/data-dot-all/dataall/pull/1181/files

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

• Does this PR introduce or modify any input fields or queries - this includes
  fetching data from storage outside the application (e.g. a database, an S3 bucket)?
  • Is the input sanitized?
  • What precautions are you taking before deserializing the data you consume?
  • Is injection prevented by parametrizing queries?
  • Have you ensured no eval or similar functions are used?
• Does this PR introduce any functionality or component that requires authorization?
  • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  • Are you logging failed auth attempts?
• Are you using or adding any cryptographic features?
  • Do you use a standard proven implementations?
  • Are the used keys controlled by the customer? Where are they stored?
• Are you introducing any new policies/roles/users?
  • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.