lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(apiserver): enforce self_ug job scopes and accept project filters (bug-1934, bug-1935)

Browse source 
bug-1934: every job-permission check read a single scope and compared it
only with "self", so a job:view or job:control grant scoped to self_ug acted
like "all" (list, get by ID, control), and self + self_ug collapsed to self.
userJobScope() now collects all of a user's grants of a job permission
before deduplication and adds them up (all; self; self_ug = the user and
everyone sharing a user group). The job list appends a submit_user filter
for narrower scopes, get-by-ID keeps covered rows in a new slice (removing
from the ranged slice skipped rows) and answers 403, both control paths
and job output check the owner against the scope. User groups now reach
the apiserver: the config push converts cluster_config_t.ugroups and
OnUserGroupsUpdated() replaces the new store (nested groups, all,
exclusions). The default basic_user now also sees its user-group mates'
jobs, as its configuration says.

bug-1935: project_name and license_project are accepted job filters, so
xcecli jobs list -P works.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 06:56:57 +00:00
parent 6114f16dac
commit 4a38bb3ca9
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
18 changed files with 750 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/frontend/apiserver/controllers/jobs_handler_test.go
View file

@ -125,6 +125,13 @@ type handlerFixture struct {
// restored in t.Cleanup.
func newHandlerFixture(t *testing.T) *handlerFixture {
t.Helper()
return newHandlerFixtureAs(t, handlerTestRBAC, handlerTestUser, "handler_tester")
}
// newHandlerFixtureAs is newHandlerFixture with the RBAC config and the
// signed user and role given (bug-1934: tests of narrower job scopes).
func newHandlerFixtureAs(t *testing.T, rbac, user, role string) *handlerFixture {
t.Helper()
// Save every global this fixture (or setupRBACTest) replaces.
origJobs, origArrayJobs, origQueues, origHosts := store.Jobs, store.ArrayJobs, store.Queues, store.Hosts
@ -134,6 +141,7 @@ func newHandlerFixture(t *testing.T) *handlerFixture {
origSubmit, origControl := submitJob, controlJob
origJobCfg, origLog, origAuthCfg := utils.JobYamlConfig, utils.Log, utils.AuthenticationYamlConfig
origRBAC := rbacConfig
origUserGroups := store.UserGroupsSnapshot()
t.Cleanup(func() {
store.Jobs, store.ArrayJobs, store.Queues, store.Hosts = origJobs, origArrayJobs, origQueues, origHosts
@ -143,15 +151,16 @@ func newHandlerFixture(t *testing.T) *handlerFixture {
submitJob, controlJob = origSubmit, origControl
utils.JobYamlConfig, utils.Log, utils.AuthenticationYamlConfig = origJobCfg, origLog, origAuthCfg
rbacConfig = origRBAC
store.SetUserGroups(origUserGroups)
})
// Auth/RBAC (replaces the stores with empty ones), then config.
setupRBACTest(t, handlerTestRBAC)
setupRBACTest(t, rbac)
utils.JobYamlConfig = &utils.JobConfig{MaxArraySize: 1000}
f := &handlerFixture{
t: t,
token: signTestJWT(handlerTestUser, "handler_tester", time.Now().Add(time.Hour)),
token: signTestJWT(user, role, time.Now().Add(time.Hour)),
nextID: handlerTestOrdinaryBase,
nextArray: handlerTestArrayBase,
}
@ -202,6 +211,7 @@ func newHandlerFixture(t *testing.T) *handlerFixture {
g := r.Group("/xce/v1/jobs")
g.GET("", jc.GetJobsInfo)
g.GET("/:jobids", jc.GetJobByIDs)
g.GET("/:jobids/output", jc.GetJobOutput)
g.POST("/create", jc.CreateJob)
g.POST("/:jobids/control", jc.ControlJobByID)
g.POST("/:jobids/restart", jc.RestartJobByID)