The GitHub Actions job "Required Checks" on texera.git/fix/clone-workflow-read-access has succeeded. Run started by GitHub user aglinxinyuan (triggered by aglinxinyuan).
Head commit for run: 522abefec4a4039a084f30727b29df27ead9bf7d / Xinyuan Lin <[email protected]> fix(amber): guard cloneWorkflow with a read-access check cloneWorkflow fetched the source by wid and copied its content into a workflow owned by the caller, with no access check on the way in. Any authenticated REGULAR user could POST /workflow/clone/<wid> for a wid they hold no privilege on and receive a full copy of a private workflow's content. Every sibling guards: retrieveWorkflow and duplicateWorkflow call hasReadAccess directly, and the version endpoint cloneVersion inherits the check through retrieveWorkflowVersion. cloneWorkflow was the one that did not, which reads as an oversight rather than a decision -- SECURITY.md states that REGULAR users cannot access other users' private resources without granted permissions. Add the same guard the siblings use. hasReadAccess already returns true for public workflows, so the hub's clone button -- the only caller, and always on a published workflow -- is unaffected; a caller holding an explicit READ grant is likewise still able to clone, which the new tests pin alongside the rejection. Report URL: https://github.com/apache/texera/actions/runs/31671630304 With regards, GitHub Actions via GitBox
