The GitHub Actions job "Required Checks" on texera.git/gh-readonly-queue/main/pr-7014-123b9f9b8ba6f571810543653be8af267e659938 has failed. Run started by GitHub user mengw15 (triggered by mengw15).
Head commit for run: 2428586deaac9aad5623d021afab5b295d7f20e5 / Meng Wang <[email protected]> fix(amber): require auth on retrieveWorkflowRuntimeStatistics (#7014) ### What changes were proposed in this PR? `retrieveWorkflowRuntimeStatistics` (`GET /executions/{wid}/stats/{eid}`) was the only endpoint in `WorkflowExecutionsResource` declaring neither `@RolesAllowed` nor an `@Auth` parameter — every other handler in the class carries `@RolesAllowed(Array("REGULAR", "ADMIN"))` + `@Auth sessionUser`, and there is no class-level annotation to fall back on. Auth is enforced per-method via `RolesAllowedDynamicFeature`, so this one handler was reachable without authentication. - Add `@RolesAllowed(Array("REGULAR", "ADMIN"))` and an `@Auth sessionUser: SessionUser` parameter, matching the sibling endpoints exactly. - Add an **auth-annotation audit test** to `WorkflowExecutionsResourceSpec`: it reflects over every `@GET/@PUT/@POST/@DELETE` handler in the class and asserts each declares `@RolesAllowed` and takes an `@Auth` parameter — so any future endpoint added without auth turns the suite red instead of shipping unprotected. `exportResultToLocal` is explicitly exempted with a comment: it serves a browser form-submit download (which can't carry an `Authorization` header), so its JWT arrives as a form field and is verified in-method via `JwtParser.parseToken`, including the role check. The frontend is unaffected: `JwtModule` attaches the `Authorization` header to every request (`app.module.ts`), and the same service already calls sibling endpoints that require auth. ### Any related issues, documentation, discussions? Closes #6977. ### How was this PR tested? - The audit test **fails before the fix**, naming exactly `retrieveWorkflowRuntimeStatistics` as the offender, and passes after — the failing run is the repro for the issue. (Its first run also flagged `exportResultToLocal`; on inspection that endpoint authenticates manually by design — see above — which is why the exemption is explicit and documented rather than silent.) - Full `WorkflowExecutionsResourceSpec` run locally: all tests pass; `WorkflowExecutionService/scalafmtCheck` (main + Test) passes. - Verified no other caller of the method exists (the added parameter breaks no call site), and that all sibling endpoints use the identical annotation pattern being applied here. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (claude-opus-4-8) --------- Signed-off-by: Xinyuan Lin <[email protected]> Co-authored-by: Xinyuan Lin <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Report URL: https://github.com/apache/texera/actions/runs/30428693847 With regards, GitHub Actions via GitBox
