[jsalinasnttdata]

🗣 Description

Updated domain authorization so users can only retrieve domains belonging to organizations they are allowed to access. Standard users are limited to their organization memberships, regional administrators are limited to their region, and global administrators retain full access.

Existing unauthorized domains return HTTP 403, while nonexistent domains return HTTP 404. The frontend routes these responses to approved Access Denied and Not Found pages.

💭 Motivation and context

Closes CRASM-4315

The direct GET /domain/{domain_id} endpoint previously returned domain, vulnerability, service, and organization data without validating the user’s access to the domain’s organization. This allowed cross-organization access when a user knew another domain’s UUID.

Authorization is now applied to the database queryset before related data is loaded or returned. The access logic is centralized and reused by direct domain lookup and domain search.

🧪 Testing

Added regression tests covering:

• Authorized standard users
• Cross-organization access denial
• Users without organization memberships
• Regional administrator access boundaries
• Global-view administrator access
• Unauthenticated requests
• Unauthorized and nonexistent domain IDs

Frontend tests cover the approved 403 and 404 pages.

The remaining frontend vulnerability-scan failure is caused by existing dependency vulnerabilities unrelated to this PR. No frontend dependency files were changed.

📷 Screenshots (if appropriate)

/403

/404

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• AI was used for research and/or understanding purposes while creating this pull request.
• AI was used to generate code in this PR (either fully or in part).
  • I attest that I understand the AI-generated code and its functionality.
  • I am comfortable answering questions about the implementation of the AI-generated code.
• All new and existing tests pass.
• Bump major, minor, patch, pre-release, and/or build versions as appropriate via the bump_version script if this repository is versioned and the changes in this PR warrant a version bump.
• Create a pre-release (necessary if and only if the pre-release version was bumped).

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release (necessary if and only if the version was bumped).

[ameliav]

Functionality is working as intended

[hawkishpolicy]

Tested locally and 403/404 scenarios are working as intended and provide appropriate message based on the situation.

Has test coverage.

LGTM.