fix!: enforce read authorization on referenced task lookup - #1005
Merged
Conversation
ehsavoie
force-pushed
the
reference_tasks
branch
2 times, most recently
from
August 3, 2026 16:33
054c9bf to
46c0960
Compare
kabir
requested changes
Aug 4, 2026
ehsavoie
force-pushed
the
reference_tasks
branch
3 times, most recently
from
August 4, 2026 14:45
e171bef to
cc6c7ec
Compare
Collaborator
Author
|
Should be all good @kabir |
ehsavoie
force-pushed
the
reference_tasks
branch
from
August 4, 2026 15:09
cc6c7ec to
926ed8a
Compare
kabir
approved these changes
Aug 4, 2026
kabir
changed the title
ehsavoie
force-pushed
the
reference_tasks
branch
from
August 4, 2026 16:46
926ed8a to
351a999
Compare
…okup - Authorize referenceTaskIds through TaskAuthorizationProvider before populating RequestContext; fail with TaskNotFoundError on denial - Rename validateRequestedTask → authorizeTaskAccess, passing ServerCallContext for auth checks in streaming/subscribe paths - Replace DefaultRequestHandler.create() with Builder pattern - Make populate-referred-tasks configurable (a2a.request-context) - Standardize fail-closed authorization in both TaskStore impls Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>
Replace response.pipe() with response.body() for non-SSE responses in executeAsyncSSE to prevent "Response already ended" when small error bodies are fully received before pipe attaches. Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>
ehsavoie
force-pushed
the
reference_tasks
branch
from
August 4, 2026 17:02
351a999 to
e137a3d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Filter referenced tasks (referenceTaskIds) through TaskAuthorizationProvider before populating the RequestContext, so callers cannot read tasks they are not authorized to access.
Pass ServerCallContext to validateRequestedTask so the authorization decorator can check read permissions when streaming or subscribe requests reference an existing task. Without this, an unauthorized caller could probe for task existence via sendStreamingMessage or subscribeToTask.