curl -k -s -u admin:admin -H 'Content-Type: application/json' -H 'Accept: application/json' http://localhost:3000/katello/api/repositories/|json_reformat returns all the repositories including ones that can't be accessed by the user or don't belong to katello. Ideally we would like to not have this URL available and instead force the user to do something like http://localhost:3000/katello//api/organizations/ACME_Corporation/environments/1/repositories or http://localhost:3000/katello//api/organizations/ACME_Corporation/repositories so that the repos are filtered by org. If we HAVE to allow http://localhost:3000/katello/api/repositories/ then make sure that the repos are accessible by the user (now that the repo model is in the database this should be easier to implement)
This route wasn't used anywhere so I removed it. It also doesn't make much sense to to list all repos independently of organizations. The route is gone in katello-0.1.175-1.