mirror of
https://github.com/dograh-hq/dograh.git
synced 2026-07-13 11:22:14 +02:00
f32395f859
* fix(auth): allow invited org members to start workflow runs Users invited to an org could not start workflows belonging to that org because the authorization check compared actor.selected_organization_id directly against workflow.organization_id. An invited user's selected org correctly reflects the invited org, but if the Stack Auth token resolves to a different org id than expected the strict equality fails. Per api/AGENTS.md: "Whenever you read or write an organization-scoped field, you must filter or validate by organization_id." The correct policy is org membership, not selected-org identity. - Add is_user_member_of_organization() to OrganizationClient; queries the organization_users association table directly (no lazy-load risk). - Replace the identity check in authorize_workflow_run_start() with a membership lookup. Deny when actor_user.id is not in the org's member set; error_code stays workflow_not_found to avoid leaking existence. - Update test: rename rejects_actor_from_another_org to rejects_actor_not_a_member (reflects actual policy), add positive test allows_invited_member that seeds membership and asserts has_quota=True. Closes #491 * fix(auth): skip membership check for personal workflows (organization_id=None) When workflow.organization_id is None (personal or legacy workflow with no org), the membership lookup was still called, producing a SQL IS NULL comparison that matched nothing and denied the run. Guard the check so it only runs when the workflow is org-scoped. Adds a regression test confirming that an actor with a known id can start a personal workflow without triggering is_user_member_of_organization. * fix(auth): fail closed on workflow membership lookup errors --------- Co-authored-by: Abhishek Kumar <abhishek@a6k.me> |
||
|---|---|---|
| .. | ||
| auth | ||
| campaign | ||
| configuration | ||
| filesystem | ||
| gen_ai | ||
| gender | ||
| integrations | ||
| pipecat | ||
| reports | ||
| telephony | ||
| voice_prompting_guide | ||
| worker_sync | ||
| workflow | ||
| managed_model_services.py | ||
| mps_billing.py | ||
| mps_service_key_client.py | ||
| organization_context.py | ||
| organization_preferences.py | ||
| posthog_client.py | ||
| quota_service.py | ||
| storage.py | ||
| tool_management.py | ||
| user_onboarding.py | ||
| workflow_run_artifacts.py | ||
| workflow_run_billing.py | ||