allow shared service users to determine which spaces their service is in

app/controllers/services/service_instances_controller.rb

@@ -241,8 +241,6 @@ def enumerate_shared_to_information(guid)
       service_instance = find_service_instance(guid)
       validate_service_instance_access(service_instance)
 
-      validate_access(:read, service_instance.space)
-
       associated_controller = VCAP::CloudController::SpacesController
       associated_path = "#{self.class.url_for_guid(guid, service_instance)}/shared_to"
 

app/controllers/v3/service_instances_controller.rb

@@ -173,7 +173,7 @@ def unshare_service_instance
 
   def relationships_shared_spaces
     service_instance = ServiceInstance.first(guid: hashed_params[:guid])
-    resource_not_found!(:service_instance) unless service_instance && can_read_from_space?(service_instance.space)
+    resource_not_found!(:service_instance) unless service_instance && can_read_service_instance?(service_instance)
 
     message = SharedSpacesShowMessage.from_params(query_params)
     invalid_param!(message.errors.full_messages) unless message.valid?
@@ -189,7 +189,7 @@ def relationships_shared_spaces
 
   def shared_spaces_usage_summary
     service_instance = ServiceInstance.first(guid: hashed_params[:guid])
-    service_instance_not_found! unless service_instance.present? && can_read_from_space?(service_instance.space)
+    service_instance_not_found! unless service_instance.present? && can_read_service_instance?(service_instance)
 
     render status: :ok, json: Presenters::V3::SharedSpacesUsageSummaryPresenter.new(service_instance)
   end

docs/v3/source/includes/resources/service_instances/_get_shared_spaces_usage_summary.md.erb

@@ -26,7 +26,7 @@ This endpoint returns the number of bound apps in spaces where the service insta
 #### Definition
 `GET /v3/service_instances/:guid/relationships/shared_spaces/usage_summary`
 
-#### Permitted roles (in the service instance's originating space)
+#### Permitted roles
  |
 --- | ---
 Admin |
@@ -36,3 +36,4 @@ Org Manager |
 Space Auditor |
 Space Developer |
 Space Manager |
+Space Supporter |

docs/v3/source/includes/resources/service_instances/_list_shared_spaces.md.erb

@@ -38,7 +38,7 @@ Resource            | Allowed Keys
 space | `guid`, `name`, `relationships.organization`
 space.organization| `guid`, `name`
 
-#### Permitted roles (in the service instance's originating space)
+#### Permitted roles
  |
 --- |
 Admin |

spec/request/service_instances_spec.rb

@@ -4058,10 +4058,10 @@ def check_filtered_instances(*instances)
       end
     end
 
-    it 'respond with 404 when the user cannot read the originating space' do
+    it 'respond with 200 when the user cannot read the originating space, but has access to the service instance' do
       set_current_user_as_role(role: 'space_developer', org: other_space.organization, space: other_space, user: user)
       get "/v3/service_instances/#{instance.guid}/relationships/shared_spaces", nil, user_header
-      expect(last_response.status).to eq(404)
+      expect(last_response.status).to eq(200)
     end
 
     describe 'fields' do
@@ -4188,14 +4188,14 @@ def create_bindings(instance, space:, count:)
       end
     end
 
-    context 'when the user cannot read from the originating space' do
-      it 'responds with 404 Not Found' do
+    context 'when the user has access to the service through a shared space' do
+      it 'responds with 200 ok' do
         user = VCAP::CloudController::User.make
         set_current_user_as_role(role: 'space_developer', org: space_2.organization, space: space_2, user: user)
 
         api_call.call(headers_for(user))
 
-        expect(last_response).to have_status_code(404)
+        expect(last_response).to have_status_code(200)
       end
     end
   end

spec/unit/controllers/services/service_instances_controller_spec.rb

@@ -4642,10 +4642,9 @@ def verify_forbidden(user)
                   )
                 end
 
-                it 'has a 403 http status code' do
+                it 'has a 200 http status code' do
                   get "/v2/service_instances/#{instance.guid}/shared_to"
-                  expect(last_response.status).to eq(403)
-                  expect(Oj.load(last_response.body)['description']).to eq('You are not authorized to perform the requested action')
+                  expect(last_response.status).to eq(200), "Expected 200, got: #{last_response.status}, role: #{role}"
                 end
               end
             end