mirror of
https://github.com/dograh-hq/dograh.git
synced 2026-07-10 11:12:13 +02:00
f32395f859
* fix(auth): allow invited org members to start workflow runs Users invited to an org could not start workflows belonging to that org because the authorization check compared actor.selected_organization_id directly against workflow.organization_id. An invited user's selected org correctly reflects the invited org, but if the Stack Auth token resolves to a different org id than expected the strict equality fails. Per api/AGENTS.md: "Whenever you read or write an organization-scoped field, you must filter or validate by organization_id." The correct policy is org membership, not selected-org identity. - Add is_user_member_of_organization() to OrganizationClient; queries the organization_users association table directly (no lazy-load risk). - Replace the identity check in authorize_workflow_run_start() with a membership lookup. Deny when actor_user.id is not in the org's member set; error_code stays workflow_not_found to avoid leaking existence. - Update test: rename rejects_actor_from_another_org to rejects_actor_not_a_member (reflects actual policy), add positive test allows_invited_member that seeds membership and asserts has_quota=True. Closes #491 * fix(auth): skip membership check for personal workflows (organization_id=None) When workflow.organization_id is None (personal or legacy workflow with no org), the membership lookup was still called, producing a SQL IS NULL comparison that matched nothing and denied the run. Guard the check so it only runs when the workflow is org-scoped. Adds a regression test confirming that an actor with a known id can start a personal workflow without triggering is_user_member_of_organization. * fix(auth): fail closed on workflow membership lookup errors --------- Co-authored-by: Abhishek Kumar <abhishek@a6k.me> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| agent_trigger_client.py | ||
| api_key_client.py | ||
| base_client.py | ||
| campaign_client.py | ||
| database.py | ||
| db_client.py | ||
| embed_token_client.py | ||
| filters.py | ||
| folder_client.py | ||
| integration_client.py | ||
| knowledge_base_client.py | ||
| models.py | ||
| organization_client.py | ||
| organization_configuration_client.py | ||
| organization_usage_client.py | ||
| reports_client.py | ||
| telephony_configuration_client.py | ||
| telephony_phone_number_client.py | ||
| tool_client.py | ||
| user_client.py | ||
| webhook_credential_client.py | ||
| webhook_delivery_client.py | ||
| workflow_client.py | ||
| workflow_recording_client.py | ||
| workflow_run_client.py | ||
| workflow_run_text_session_client.py | ||
| workflow_template_client.py | ||