From 14d08b24c309d42f3c36d310f83f167b6b0a1bfc Mon Sep 17 00:00:00 2001 From: Frikky Date: Mon, 27 Jan 2025 12:55:30 +0100 Subject: [PATCH] Fixed so org editor has more control of org workflows --- backend/go-app/main.go | 2 +- backend/go-app/walkoff.go | 23 +++++------------------ functions/onprem/orborus/Dockerfile | 2 +- functions/onprem/orborus/orborus.go | 2 +- 4 files changed, 8 insertions(+), 21 deletions(-) diff --git a/backend/go-app/main.go b/backend/go-app/main.go index 53d0f498..6136f64f 100755 --- a/backend/go-app/main.go +++ b/backend/go-app/main.go @@ -4842,7 +4842,7 @@ func makeWorkflowPublic(resp http.ResponseWriter, request *http.Request) { // FIXME - add org check too, and not just owner // Check workflow.Sharing == private / public / org too if user.Id != workflow.Owner || len(user.Id) == 0 { - if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + if workflow.OrgId == user.ActiveOrg.Id { log.Printf("[AUDIT] User %s is accessing workflow %s as admin (public)", user.Username, workflow.ID) } else { log.Printf("[AUDIT] Wrong user (%s) for workflow %s (public)", user.Username, workflow.ID) diff --git a/backend/go-app/walkoff.go b/backend/go-app/walkoff.go index 09e2bc11..3e924ca4 100755 --- a/backend/go-app/walkoff.go +++ b/backend/go-app/walkoff.go @@ -614,7 +614,7 @@ func handleGetStreamResults(resp http.ResponseWriter, request *http.Request) { return } - if len(workflowExecution.ExecutionOrg) > 0 && user.ActiveOrg.Id == workflowExecution.ExecutionOrg && user.Role == "admin" { + if len(workflowExecution.ExecutionOrg) > 0 && user.ActiveOrg.Id == workflowExecution.ExecutionOrg { //log.Printf("[DEBUG] User %s is in correct org. Allowing org continuation for execution!", user.Username) } else { log.Printf("[WARNING] Bad authorization key when getting stream results %s.", actionResult.ExecutionId) @@ -965,7 +965,7 @@ func deleteWorkflow(resp http.ResponseWriter, request *http.Request) { } if user.Id != workflow.Owner || len(user.Id) == 0 { - if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + if workflow.OrgId == user.ActiveOrg.Id { log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner) } else { log.Printf("[WARNING] Wrong user (%s) for workflow %s (delete workflow)", user.Username, workflow.ID) @@ -1939,7 +1939,7 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) { if !executionAuthValid { if user.Id != workflow.Owner && user.Role != "scheduler" && user.Role != fmt.Sprintf("workflow_%s", fileId) { - if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + if workflow.OrgId == user.ActiveOrg.Id { log.Printf("[AUDIT] Letting user %s execute %s because they're admin of the same org", user.Username, workflow.ID) } else { log.Printf("[AUDIT] Wrong user (%s) for workflow %s (execute)", user.Username, workflow.ID) @@ -2029,7 +2029,7 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) { } if user.Id != workflow.Owner || len(user.Id) == 0 { - if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + if workflow.OrgId == user.ActiveOrg.Id { log.Printf("[AUDIT] User %s is accessing workflow %s as admin (stop schedule)", user.Username, workflow.ID) } else { log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID) @@ -2039,19 +2039,6 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) { } } - //if user.Id != workflow.Owner || len(user.Id) == 0 { - // if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { - // log.Printf("[INFO] User %s is accessing workflow %s as admin", user.Username, workflow.ID) - // } else if workflow.Public { - // log.Printf("[INFO] Letting user %s access workflow %s because it's public", user.Username, workflow.ID) - // } else { - // log.Printf("[WARNING] Wrong user (%s) for workflow %s (get workflow)", user.Username, workflow.ID) - // resp.WriteHeader(401) - // resp.Write([]byte(`{"success": false}`)) - // return - // } - //} - schedule, err := shuffle.GetSchedule(ctx, scheduleId) if err != nil { log.Printf("[WARNING] Failed finding schedule %s", scheduleId) @@ -2279,7 +2266,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) { } if user.Id != workflow.Owner || len(user.Id) == 0 { - if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + if workflow.OrgId == user.ActiveOrg.Id { log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner) } else { log.Printf("[WARNING] Wrong user (%s) for workflow %s (schedule start). Owner: %s", user.Username, workflow.ID, workflow.Owner) diff --git a/functions/onprem/orborus/Dockerfile b/functions/onprem/orborus/Dockerfile index 59ef632f..e5dfea8a 100644 --- a/functions/onprem/orborus/Dockerfile +++ b/functions/onprem/orborus/Dockerfile @@ -2,7 +2,6 @@ FROM golang:1.22 as builder WORKDIR /app -# COPY go.* ./ COPY orborus.go /app/orborus.go COPY go.mod /app/go.mod @@ -20,4 +19,5 @@ ENV ENVIRONMENT_NAME=Shuffle \ BASE_URL=http://shuffle-backend:5001 \ DOCKER_API_VERSION=1.40 \ SHUFFLE_OPENSEARCH_URL=https://opensearch:9200 + CMD ["./orborus"] diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go index 63712c08..b0a7094d 100755 --- a/functions/onprem/orborus/orborus.go +++ b/functions/onprem/orborus/orborus.go @@ -3653,7 +3653,7 @@ func zombiecheck(ctx context.Context, workerTimeout int) error { // Check image name if !shuffleFound { - //log.Printf("[WARNING] Zombie container skip: %#v, %s", container.Labels, container.Image) + //log.Printf("[DEBUG] Zombie container skip: %#v, %s", container.Labels, container.Image) continue } //} else {