GameCult/repixelizer
Watch
9
0
Fork
You've already forked repixelizer
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use app access for owned job routes

Browse source
This commit is contained in:
Meta Vens 2026-04-29 12:51:19 +01:00
commit 2d5c244606
2 changed files with 7 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/repixelizer/gui.py
View file

@ -1012,8 +1012,7 @@ def create_app():
elif path == "/api/jobs" and request.method.upper() == "POST":
subject = access_controller.require_request_capability(request, "queue_submit")
elif path.startswith("/api/jobs/"):
capability = "job_cancel_own" if request.method.upper() == "DELETE" else "job_read_own"
subject = resolve_job_subject(capability)
subject = resolve_job_subject("app_access")
elif path in {"/app", "/app/"}:
if access_controller.runtime.enabled and access_controller.runtime.required:
subject = access_controller.require_request_capability(request, "app_access")
@ -1111,7 +1110,7 @@ def create_app():
if job is None:
raise HTTPException(status_code=404, detail="Unknown job")
try:
access_controller.require_current_job_access(job, "job_read_own")
access_controller.require_current_job_access(job, "app_access")
except AccessDenied as exc:
raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
payload = manager.get_job_state_payload(job_id)
@ -1186,7 +1185,7 @@ def create_app():
if job is None:
raise HTTPException(status_code=404, detail="Unknown job")
try:
access_controller.require_current_job_access(job, "job_read_own")
access_controller.require_current_job_access(job, "app_access")
except AccessDenied as exc:
raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
payload = manager.heartbeat(job_id)
@ -1199,7 +1198,7 @@ def create_app():
if job is None:
raise HTTPException(status_code=404, detail="Unknown job")
try:
access_controller.require_current_job_access(job, "job_cancel_own")
access_controller.require_current_job_access(job, "app_access")
except AccessDenied as exc:
raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
payload = manager.cancel_job(job_id, "Canceled because the browser left or explicitly bailed.")
@ -1212,7 +1211,7 @@ def create_app():
if job is None:
raise HTTPException(status_code=404, detail="Unknown job")
try:
access_controller.require_current_job_access(job, "job_read_own")
access_controller.require_current_job_access(job, "app_access")
except AccessDenied as exc:
raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc

4
tests/test_gui.py
View file

@ -908,7 +908,7 @@ def test_gui_job_routes_enforce_bound_subject_ownership(monkeypatch, tmp_path: P
account_id="acct-1",
session_id="sess-1",
access_revision=4,
capabilities=frozenset({"queue_submit", "job_read_own", "job_cancel_own"}),
capabilities=frozenset({"app_access", "queue_submit"}),
auth_mode="trusted-header",
)
with bind_access_subject(subject):
@ -936,7 +936,7 @@ def test_gui_job_routes_enforce_bound_subject_ownership(monkeypatch, tmp_path: P
account_id="acct-2",
session_id="sess-2",
access_revision=8,
capabilities=frozenset({"job_read_own"}),
capabilities=frozenset({"app_access"}),
auth_mode="trusted-header",
)
with bind_access_subject(intruder):