---
id: "bug-1934"
status: "open"
status_updated: "2026-10-10"
status_note: "newly logged"
component: "apiserver"
severity: "security"
timestamp: "2026-10-10T04:31:25Z"
last_seen: "2026-10-10T04:31:25Z"
occurrences: 1
files: ["src/frontend/apiserver/controllers/jobs.go", "src/frontend/apiserver/controllers/rbac_check.go", "src/frontend/apiserver/models/roles.go", "src/frontend/apiserver/config/rbac.yaml"]
tags: ["apiserver", "rbac", "security", "self_ug"]
related: ["bug-1935"]
---

# bug-1934: apiserver treats a job:view grant scoped only to self_ug as all: user sees every user's jobs

## Description
**Observed:** (source reading, not yet run) a role whose `job:view` grant is
scoped only to `self_ug` can see every user's jobs. The job-list handler
(`src/frontend/apiserver/controllers/jobs.go`) only distinguishes
`DomainType == self`:
```go
if permission.DomainType != models.DomainTypeSelf {
    submitUser = filter.Value            // jobs.go:178, caller-chosen user
}
...
if !specify_user || permission.DomainType == models.DomainTypeSelf {   // :187
...
if jobPermission.DomainType == models.DomainTypeSelf {   // :762, per-row owner filter
```
so `self_ug` falls through every check like `all`: a `submit_user` filter
naming any user (or `all`) is honoured and no row is removed.
`GetRequireResourcePermission()` (`controllers/rbac_check.go:323-346`)
returns only the first grant matching the permission, so for the default
`basic_user` (`config/rbac.yaml:37-40`, `job:view` with `self` then
`self_ug`) the `self` entry wins and `self_ug` is silently ignored.
`self_ug` is accepted by role validation (`controllers/roles.go:697-700`)
and listed as a supported job scope (`models/roles.go:70`), but nothing
resolves the user's user groups for it.

**Expected:** a `self_ug` job grant covers exactly the jobs whose owner shares
a user group with the requester; a grant list with several scopes covers the
union of them; anything else is rejected or filtered out.
**Impact:** security (authorization bypass). Any role an admin creates with
`job:view` (or another job permission, unchecked) scoped to `self_ug` grants
visibility of all users' jobs. The default `basic_user` is not exposed (its
`self` grant is matched first) but never gets the group visibility its
config promises. Other job permissions using the same single-grant lookup
were not checked yet.
**Found by:** review, during `/kiro-spec-requirements project-config`
(2026-10-10, RBAC survey for project-scoped job permissions).

## Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver
- Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it
- Code: scheduler-framework @ 54c8b29e
- Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet

## Reproduction
1. Start an apiserver with a role `ug_viewer` granting `job:view` with only
   `- type: self_ug`, plus `queue:view` on `all`, assigned to user `alice`;
   submit a job as user `bob`.
2. As `alice`: `xcecli jobs list -u bob` (or `-u all`), or
   `GET /api/v1/jobs?filters={submit_user:eq:bob}`.
3. Expected: rejected or empty (unless alice and bob share a user group);
   per the source reading, bob's job is returned.
- Frequency: deterministic by code reading; not yet executed.
- Evidence: the code lines quoted in Description; no logs.

## Root cause
TODO: required for fixed/partial

## Fix
TODO: required for fixed/partial

## Verification
- Test: TODO: name + file; RED before the fix, GREEN after
- Suites: TODO: suite results and build profile
- Live: TODO: soak/deploy run, or n/a and why

## References
- Related: none