Repository navigation
feat(orchestration): let people read run nodes, triggers and ticks - #1332
Merged
Merged
Conversation
A refused location listing named the nodes the person could not view and read differently for a location that does not exist. Listing refusals now carry one fixed message with the decision ID, identical for unassigned and unknown locations. The audit event keeps the missing nodes.
Every refusal from person authorization now shows fixed text per action and its decision ID; the audit event keeps the missing nodes. Unknown jobs and triggers are refused only after the caller is authorized for the target, so an unknown object reads the same as a forbidden one.
Person sessions can read a run's nodes, the target's triggers and a trigger's ticks. Each read authorizes like the runs list, with view on every current node of the target, before looking the object up, so an unknown run or trigger gets the same refusal as a forbidden one. A person who may view the whole target gets 404 for an unknown object. The machine reads share the same in-transaction queries. Validated locally with SQLite and PostgreSQL: orchestration API tests, including the forbidden-versus-unknown denial cases for the new reads (a lookup-before-authorize mutation fails them) and the per-role session matrix; clippy, fensu, and the regenerated TypeScript client check and test. Not yet reviewed; stacked on the listing-denial branch.
…at/person-run-trigger-reads
One store read decides whether a person's target-scoped read may name a run or a trigger. The handler and per-record read shapes join the existing duplicate allowlists.
…er-reads # Conflicts: # crates/sqlbuild-orchestration/src/authorization/main/mod.rs # crates/sqlbuild-orchestration/tests/api/test_denials.rs
kvlonge
enabled auto-merge (squash)
November 6, 2026 18:40
…er-reads # Conflicts: # crates/sqlbuild-orchestration/src/api/models.rs # crates/sqlbuild-orchestration/tests/api/test_denials.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The live UI shows a run's node outcomes, a target's triggers and each trigger's tick log. Until now only machine credentials could read these. People need the same reads, under the same rules as listing a target's runs: a refusal must not reveal whether an object exists.
Changes
GET .../targets/{target}/runs/{run_id}/nodes,.../triggersand.../triggers/{trigger_id}/ticks.Verification
make check-ci. The TypeScript client check and tests pass.