[backend] secure organization deletion (#8838)

[SouadHadjiat]

Proposed changes

• add protections to prevent organization deletion if it's a platform organization, if it has an administrator, if it has members
• call organizationDelete in retention manager (however it doesn't delete permanently, it will go in trash => I don't think it's an issue, since organization delete can be quite destructive, so it's better we keep it in trash in case)
• add tests

Related issues

• Prevent deletion of the organization that is used as plateforme organization or attibuted to a user #8838

To test : organization can't be deleted if it is used as platform organization, or it has at least one member (user part of the organization), or has an organization admin (org admin is also a member, but the error message is different). Otherwise the deletion should work. Also error message is different for users depending on their capability : if user has set access, the message will explain the reason (members or orga admin reason).

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case (coverage and e2e)
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

[codecov]

Codecov Report

Attention: Patch coverage is 68.18182% with 14 lines in your changes missing coverage. Please review.

Project coverage is 66.65%. Comparing base (ad7bbb2) to head (a50bbab).
Report is 10 commits behind head on master.

Files with missing lines	Patch %	Lines
...ql/src/modules/organization/organization-domain.ts	65.62%	11 Missing ⚠️
...latform/opencti-graphql/src/manager/taskManager.js	25.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8903      +/-   ##
==========================================
+ Coverage   66.29%   66.65%   +0.36%     
==========================================
  Files         597      597              
  Lines       61033    61087      +54     
  Branches     6276     6604     +328     
==========================================
+ Hits        40460    40716     +256     
+ Misses      20573    20371     -202     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Archidoit]

Behavior ok, working well 👍

[Archidoit]

⚠️ We can still delete a platform organization via a background task in Data > Entities

[SouadHadjiat]

⚠️ We can still delete a platform organization via a background task in Data > Entities

you're right, task manager calls directly deleteElementById, I need to change it as I did with retention manager => should be fixed now

[Archidoit]

wouln't it be better to add the organization check in 'deleteElementById' ? to avoid forgetting to add the check when using it?

[lndrtrbn]

That would probably make circle dependencies as organizationDelete uses deleteElementById. Maybe having a higher level function that make those kind of checks and then redirect to the correct delete function could be a thing? But it means some global refactoring at every delete resolver, maybe not relevant inside the scope of this PR idk