fix(apiserver): enforce self_ug job scopes and accept project filters (bug-1934, bug-1935)

bug-1934: every job-permission check read a single scope and compared it
only with "self", so a job:view or job:control grant scoped to self_ug acted
like "all" (list, get by ID, control), and self + self_ug collapsed to self.
userJobScope() now collects all of a user's grants of a job permission
before deduplication and adds them up (all; self; self_ug = the user and
everyone sharing a user group). The job list appends a submit_user filter
for narrower scopes, get-by-ID keeps covered rows in a new slice (removing
from the ranged slice skipped rows) and answers 403, both control paths
and job output check the owner against the scope. User groups now reach
the apiserver: the config push converts cluster_config_t.ugroups and
OnUserGroupsUpdated() replaces the new store (nested groups, all,
exclusions). The default basic_user now also sees its user-group mates'
jobs, as its configuration says.

bug-1935: project_name and license_project are accepted job filters, so
xcecli jobs list -P works.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-10 06:56:57 +00:00

4 KiB

Raw Blame History

status

status_updated

status_note

component

severity

timestamp

last_seen

occurrences

files

bug-1935: xcecli jobs list -P fails: apiserver rejects project_name filter (unsupported filter)

Description

Observed: xcecli jobs list -P <project> (-P/--project, src/frontend/xcecli/cmd/jobs/list.go:356) sends the filter {project_name:eq:<project>} (xcecli/filters/job_filter.go:108-109), but project_name is commented out of the apiserver's JOB_SUPPORT_FILTERS (src/frontend/apiserver/models/jobs.go:178), so validateJobQueryFilters() (controllers/jobs.go:470-483) rejects the request:

unsupported filter: project_name

(HTTP 400, INVALID_PARAMS). The same holds for license_project (models/jobs.go:179, job_filter.go:112-113). Found by source reading; not yet run against a live apiserver.

Expected: xcecli jobs list -P eng lists the caller's visible jobs whose project is eng. Impact: wrong result: the documented -P (and license-project) filter of xcecli jobs list always fails with an error; users cannot list jobs by project. No data is affected. Found by: review, during /kiro-spec-requirements project-config (2026-10-10); project-config Requirement 7.5 needs this filter. UPDATE (2026-10-10): confirmed by TestJobHandler_ProjectFilters (src/frontend/apiserver/controllers/job_scope_test.go) before the fix: status = 400 ... unsupported filter: project_name.

Environment

OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2), from src/xce.build/frontend/apiserver/xce_apiserver
Toolchain: go1.25.5 linux/amd64 (nix dev shell); gcc (GCC) 15.2.0, meson 1.9.1
Build: asan (xce.build) binary exists at this commit; the bug was found by reading the source, not by running it
Code: scheduler-framework @ 54c8b29e
Deployment: any apiserver deployment (single or HA); not reproduced on a running cluster yet

Reproduction

Start an apiserver (any deployment) and submit a job with xcecli jobs submit -P eng sleep 1.
xcecli jobs list -P eng
Expected: the job is listed; per the source, the apiserver replies HTTP 400 unsupported filter: project_name.

Frequency: deterministic by code reading; not yet executed.
Evidence: the code lines quoted in Description; no logs.

Root cause

JOB_SUPPORT_FILTERS (src/frontend/apiserver/models/jobs.go) had project_name and license_project commented out, and validateJobQueryFilters() (controllers/jobs.go) rejects every field not on that list, while xcecli (filters/job_filter.go:108-113) sends exactly those fields for -P and the license-project option. The job store already carries both fields (JobInfo.ProjectName, LicenseProject). Since: pre-existing, origin unknown.

Fix

models/jobs.go: project_name and license_project are now in JOB_SUPPORT_FILTERS. No other change was needed: the store query filters by the JSON field name. ARRAY_JOB_SUPPORT_FILTERS (array statistics) is unchanged.

Verification

Test: TestJobHandler_ProjectFilters (src/frontend/apiserver/controllers/job_scope_test.go): RED before (400 unsupported filter), GREEN after ({project_name:eq:eng} and {license_project:eq:lic2} select only the matching job).
Suites: same run as bug-1934: apiserver and xcecli Go tests ok, meson apiserver suite 1/1 OK, asan, 2026-10-10.
Live: n/a: the change is a filter whitelist entry exercised through the real handler and store in the test.

References

Related: bug-1934
Spec: .kiro/specs/project-config/requirements.md Requirement 7.5

4 KiB Raw Blame History