mirror of
https://github.com/dograh-hq/dograh.git
synced 2026-07-13 11:22:14 +02:00
f32395f859
* fix(auth): allow invited org members to start workflow runs Users invited to an org could not start workflows belonging to that org because the authorization check compared actor.selected_organization_id directly against workflow.organization_id. An invited user's selected org correctly reflects the invited org, but if the Stack Auth token resolves to a different org id than expected the strict equality fails. Per api/AGENTS.md: "Whenever you read or write an organization-scoped field, you must filter or validate by organization_id." The correct policy is org membership, not selected-org identity. - Add is_user_member_of_organization() to OrganizationClient; queries the organization_users association table directly (no lazy-load risk). - Replace the identity check in authorize_workflow_run_start() with a membership lookup. Deny when actor_user.id is not in the org's member set; error_code stays workflow_not_found to avoid leaking existence. - Update test: rename rejects_actor_from_another_org to rejects_actor_not_a_member (reflects actual policy), add positive test allows_invited_member that seeds membership and asserts has_quota=True. Closes #491 * fix(auth): skip membership check for personal workflows (organization_id=None) When workflow.organization_id is None (personal or legacy workflow with no org), the membership lookup was still called, producing a SQL IS NULL comparison that matched nothing and denied the run. Guard the check so it only runs when the workflow is org-scoped. Adds a regression test confirming that an actor with a known id can start a personal workflow without triggering is_user_member_of_organization. * fix(auth): fail closed on workflow membership lookup errors --------- Co-authored-by: Abhishek Kumar <abhishek@a6k.me> |
||
|---|---|---|
| .. | ||
| alembic | ||
| assets | ||
| db | ||
| errors | ||
| mcp_server | ||
| native/rnnoise | ||
| routes | ||
| schemas | ||
| services | ||
| tasks | ||
| tests | ||
| utils | ||
| .cursorignore | ||
| .dockerignore | ||
| .env.example | ||
| .env.test.example | ||
| .gitignore | ||
| __init__.py | ||
| AGENTS.md | ||
| alembic.ini | ||
| app.py | ||
| CLAUDE.md | ||
| conftest.py | ||
| constants.py | ||
| Dockerfile | ||
| enums.py | ||
| logging_config.py | ||
| pyproject.toml | ||
| pytest.ini | ||
| requirements.dev.txt | ||
| requirements.txt | ||
| sdk_expose.py | ||