Rongsong Shen
4a38bb3ca9
bug-1934: every job-permission check read a single scope and compared it only with "self", so a job:view or job:control grant scoped to self_ug acted like "all" (list, get by ID, control), and self + self_ug collapsed to self. userJobScope() now collects all of a user's grants of a job permission before deduplication and adds them up (all; self; self_ug = the user and everyone sharing a user group). The job list appends a submit_user filter for narrower scopes, get-by-ID keeps covered rows in a new slice (removing from the ranged slice skipped rows) and answers 403, both control paths and job output check the owner against the scope. User groups now reach the apiserver: the config push converts cluster_config_t.ugroups and OnUserGroupsUpdated() replaces the new store (nested groups, all, exclusions). The default basic_user now also sees its user-group mates' jobs, as its configuration says. bug-1935: project_name and license_project are accepted job filters, so xcecli jobs list -P works. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| backend | ||
| cmd | ||
| common | ||
| config | ||
| controllers | ||
| docs | ||
| middleware | ||
| models | ||
| router | ||
| services | ||
| store | ||
| tools/encrypt | ||
| utils | ||
| vendor | ||
| go.mod | ||
| go.sum | ||
| meson.build | ||
| README.md | ||
(1) run server command:
cd cmd go run main.go
(2) run server with different log level: cd cmd go run main.go -level=debug
level options: info/debug/warn/error/fatal