Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixed: job assignee can remove or update any issue created by the tas… #4436

Merged
merged 1 commit into from
Mar 10, 2022

Conversation

k1won
Copy link
Contributor

@k1won k1won commented Mar 10, 2022

…k owner #4424

Motivation and context

Resolves #4424

How has this been tested?

Manual test

Checklist

License

  • I submit my code changes under the same MIT License that covers the project.
    Feel free to contact the maintainers if that's a concern.
  • I have updated the license header for each file (see an example below)
# Copyright (C) 2022 Intel Corporation
#
# SPDX-License-Identifier: MIT

@k1won k1won requested a review from nmanovic as a code owner March 10, 2022 01:37
@@ -222,6 +222,7 @@ allow {
utils.is_sandbox
utils.has_perm(utils.WORKER)
is_issue_admin
not is_job_assignee
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will recommend to change is_issue_admin definition. Let's replace job_staff to task_staff. Thus you don't need the new condition.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nmanovic , Good idea. much better.
However, after modifying the definition of is_issue_admin, the following error occurred as a result of the rule test.

data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_BUSINESS_membership_NONE_same_org_TRUE_has_proj_TRUE: FAIL (334.385μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_BUSINESS_membership_NONE_same_org_TRUE_has_proj_FALSE: FAIL (326.482μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_USER_membership_NONE_same_org_TRUE_has_proj_TRUE: FAIL (331.52μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_USER_membership_NONE_same_org_TRUE_has_proj_FALSE: FAIL (324.097μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_NONE_same_org_TRUE_has_proj_TRUE: FAIL (331.857μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_NONE_same_org_TRUE_has_proj_FALSE: FAIL (319.203μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_NONE_membership_NONE_same_org_TRUE_has_proj_TRUE: FAIL (332.902μs)
data.issues.test_scope_VIEW_context_SANDBOX_ownership_JOB_ASSIGNEE_privilege_NONE_membership_NONE_same_org_TRUE_has_proj_FALSE: FAIL (315.895μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_BUSINESS_membership_SUPERVISOR_same_org_TRUE_has_proj_TRUE: FAIL (490.933μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_BUSINESS_membership_SUPERVISOR_same_org_TRUE_has_proj_FALSE: FAIL (486.365μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_BUSINESS_membership_WORKER_same_org_TRUE_has_proj_TRUE: FAIL (481.226μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_BUSINESS_membership_WORKER_same_org_TRUE_has_proj_FALSE: FAIL (486.961μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_USER_membership_SUPERVISOR_same_org_TRUE_has_proj_TRUE: FAIL (458.056μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_USER_membership_SUPERVISOR_same_org_TRUE_has_proj_FALSE: FAIL (456.854μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_USER_membership_WORKER_same_org_TRUE_has_proj_TRUE: FAIL (468.752μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_USER_membership_WORKER_same_org_TRUE_has_proj_FALSE: FAIL (467.93μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_OWNER_same_org_TRUE_has_proj_TRUE: FAIL (415.898μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_OWNER_same_org_TRUE_has_proj_FALSE: FAIL (421.486μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_MAINTAINER_same_org_TRUE_has_proj_TRUE: FAIL (409.93μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_MAINTAINER_same_org_TRUE_has_proj_FALSE: FAIL (420.387μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_SUPERVISOR_same_org_TRUE_has_proj_TRUE: FAIL (414.979μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_SUPERVISOR_same_org_TRUE_has_proj_FALSE: FAIL (411.665μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_WORKER_same_org_TRUE_has_proj_TRUE: FAIL (402.816μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_WORKER_membership_WORKER_same_org_TRUE_has_proj_FALSE: FAIL (401.203μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_OWNER_same_org_TRUE_has_proj_TRUE: FAIL (373.611μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_OWNER_same_org_TRUE_has_proj_FALSE: FAIL (387.152μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_MAINTAINER_same_org_TRUE_has_proj_TRUE: FAIL (376.263μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_MAINTAINER_same_org_TRUE_has_proj_FALSE: FAIL (372.317μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_SUPERVISOR_same_org_TRUE_has_proj_TRUE: FAIL (379.072μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_SUPERVISOR_same_org_TRUE_has_proj_FALSE: FAIL (366.83μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_WORKER_same_org_TRUE_has_proj_TRUE: FAIL (416.041μs)
data.issues.test_scope_VIEW_context_ORGANIZATION_ownership_JOB_ASSIGNEE_privilege_NONE_membership_WORKER_same_org_TRUE_has_proj_FALSE: FAIL (365.501μs)
--------------------------------------------------------------------------------
PASS: 2828/2860
FAIL: 32/2860

Thus I added one more is_issue_staff condition, and as a result, the rule test passed. Would be ok?

is_issue_staff {
    is_job_staff
}
$ opa test issues_test.gen.rego issues.rego utils.rego organizations.rego
PASS: 2860/2860

Copy link
Contributor

@nmanovic nmanovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@k1won , thanks for all your time!

@nmanovic nmanovic merged commit c69f10b into cvat-ai:develop Mar 10, 2022
@k1won k1won deleted the br_to_fix branch March 10, 2022 13:39
ActiveChooN added a commit that referenced this pull request Mar 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

job assignee can remove or update any issue created by the task owner
2 participants