lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(apiserver): enforce self_ug job scopes and accept project filters (bug-1934, bug-1935)

Browse source 
bug-1934: every job-permission check read a single scope and compared it
only with "self", so a job:view or job:control grant scoped to self_ug acted
like "all" (list, get by ID, control), and self + self_ug collapsed to self.
userJobScope() now collects all of a user's grants of a job permission
before deduplication and adds them up (all; self; self_ug = the user and
everyone sharing a user group). The job list appends a submit_user filter
for narrower scopes, get-by-ID keeps covered rows in a new slice (removing
from the ranged slice skipped rows) and answers 403, both control paths
and job output check the owner against the scope. User groups now reach
the apiserver: the config push converts cluster_config_t.ugroups and
OnUserGroupsUpdated() replaces the new store (nested groups, all,
exclusions). The default basic_user now also sees its user-group mates'
jobs, as its configuration says.

bug-1935: project_name and license_project are accepted job filters, so
xcecli jobs list -P works.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 06:56:57 +00:00
parent 6114f16dac
commit 4a38bb3ca9
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
18 changed files with 750 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/frontend/apiserver/controllers/rbac_check.go
View file

@ -168,6 +168,25 @@ func GetBuiltinRolePermissions(roleName string) []Permission {
// get all user permission,
// if user not exist in store, use basic_user permission
func GetUserAllPermissionsWithType(userName string) []models.RolePermission {
perms, fromRoles := collectUserPermissions(userName)
if !fromRoles {
return perms
}
permissionListsType := DeduplicatePermissions(perms)
logger.Debug("case 4 DeduplicatePermissions", zap.Any("permissionListsType", permissionListsType))
return permissionListsType
}
// collectUserPermissionsWithType returns every grant of the user, one entry
// per scope, before DeduplicatePermissions (bug-1934: job scopes add up).
func collectUserPermissionsWithType(userName string) []models.RolePermission {
perms, _ := collectUserPermissions(userName)
return perms
}
// collectUserPermissions returns the user's grants; fromRoles is false when
// the user has no roles and gets the builtin basic_user grants.
func collectUserPermissions(userName string) ([]models.RolePermission, bool) {
userRoles := store.GetUserRoleNames(userName)
if len(userRoles) == 0 {
// case 1: user not in store, use basic_user
@ -184,7 +203,7 @@ func GetUserAllPermissionsWithType(userName string) []models.RolePermission {
}
}
logger.Debug("case 1, assign basic_user permission to unregistered user")
return permissionTransform
return permissionTransform, false
}
builtInRoles := utils.IncludeBuiltinRoles(userRoles)
@ -212,9 +231,7 @@ func GetUserAllPermissionsWithType(userName string) []models.RolePermission {
permissionListsType = append(permissionListsType, GetRoleAllPermissionsWithType(userRole)...)
}
logger.Debug("case 3, before remove duplicated permissions", zap.Any("permissionListsType", permissionListsType))
permissionListsType = DeduplicatePermissions(permissionListsType)
logger.Debug("case 4 DeduplicatePermissions", zap.Any("permissionListsType", permissionListsType))
return permissionListsType
return permissionListsType, true
}
func GetRoleAllPermissionsWithType(roleName string) []models.RolePermission {