From c9dc90254b8b6d749f01e295fdecd6ffb2944d51 Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Wed, 17 Dec 2025 18:44:17 +0100 Subject: [PATCH] provisioning: use access checker for jobs and historicjobs resources Jobs resource: uses actual verb (create/read/write/delete) HistoricJobs resource: read-only (historicjobs:read) --- pkg/registry/apis/provisioning/register.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go index 1df84a3f2ad..5aedbfdd3a4 100644 --- a/pkg/registry/apis/provisioning/register.go +++ b/pkg/registry/apis/provisioning/register.go @@ -355,7 +355,13 @@ func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer { // - CRUD: connections:create/read/write/delete // - Status: connections:read // -// Other resources (stats, settings, jobs, historicjobs): +// Jobs: +// - CRUD: jobs:create/read/write/delete +// +// Historic Jobs: +// - Read-only: historicjobs:read +// +// Other resources (stats, settings): // - Admin role or AccessPolicy required func (b *APIBuilder) authorizeResource(ctx context.Context, a authorizer.Attributes, id identity.Requester) (authorizer.Decision, string, error) { switch a.GetResource() { @@ -363,7 +369,11 @@ func (b *APIBuilder) authorizeResource(ctx context.Context, a authorizer.Attribu return b.authorizeRepositorySubresource(ctx, a, id) case provisioning.ConnectionResourceInfo.GetName(): return b.authorizeConnectionSubresource(ctx, a, id) - case "stats", "settings", provisioning.JobResourceInfo.GetName(), provisioning.HistoricJobResourceInfo.GetName(): + case provisioning.JobResourceInfo.GetName(): + return b.checkAccess(ctx, id, a.GetVerb(), provisioning.GROUP, "jobs", a.GetName(), a.GetNamespace()) + case provisioning.HistoricJobResourceInfo.GetName(): + return b.checkAccess(ctx, id, apiutils.VerbGet, provisioning.GROUP, "historicjobs", a.GetName(), a.GetNamespace()) + case "stats", "settings": return allowForAdminsOrAccessPolicy(id) default: return b.authorizeDefault(id)