Copilot commented on code in PR #7014:
URL: https://github.com/apache/texera/pull/7014#discussion_r3671144320
##########
amber/src/main/scala/org/apache/texera/web/resource/dashboard/user/workflow/WorkflowExecutionsResource.scala:
##########
@@ -662,9 +662,11 @@ class WorkflowExecutionsResource {
@GET
@Produces(Array(MediaType.APPLICATION_JSON))
@Path("/{wid}/stats/{eid}")
+ @RolesAllowed(Array("REGULAR", "ADMIN"))
def retrieveWorkflowRuntimeStatistics(
@PathParam("wid") wid: Integer,
- @PathParam("eid") eid: Integer
+ @PathParam("eid") eid: Integer,
+ @Auth sessionUser: SessionUser
): List[WorkflowRuntimeStatistics] = {
// Create URI for runtime statistics
Review Comment:
This endpoint now requires authentication, but it still does not authorize
access to the workflow/execution. Unlike other GET handlers in this resource
(e.g., retrieveExecutionsOfWorkflow / retrieveInteractionHistory), it doesn’t
verify the authenticated user has read access to `wid`, so any logged-in user
could query runtime stats for workflows they can’t access. Since `sessionUser`
is now available, add an access check at the start of the method (and it also
avoids leaving `sessionUser` unused).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
