Option to restrict jobs to internal users only #419
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To allow namespaces to refuse to run jobs for guest users (using the `is_restricted` field returned by the slack api). For now we make it applicable to the entire namespace, not to individual commands.
inglesp
approved these changes
Jan 18, 2024
I did think about that, but decided maybe that went against our usual open-by-default stance. It would be easy to come back to, so I think I'll just leave it as is for now |
|
FWIW, my instinct would very much be on the side on restricting commands by default and then explicitly marking the safe ones. I don't think this needs doing immediately but maybe next time we want to add a restricted command we should invert the logic.
I think that applies to sharing information and working in the open, not to giving people permission to do stuff. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add minimal restrictions that can be applied to categories of jobs, to restrict the entire category to internal users.
For every slack message event sent, the slack API includes a user id, which we can look up to get the value of
is_restricted, which is True if the user is a guest (i.e. external) user.I've updated the job config to restrict the jobs that I think we care about - op, fdaaa, funding and techsupport (techsupport for the out of office on/off commands, not the rota). For the others, I don't think we're concerned about external users seeing the project boards, logs, or outputchecking rota.