fix(confluence): index inherited page restrictions for DLS (#4095) - #4297
Conversation
A Confluence page with "No restrictions" of its own still inherits the view restrictions of its ancestors, but the connector ignored them and fell back to the broader space-level permissions. This over-granted access in indexed _allow_access_control values. Resolve the effective inherited ACL by walking a page's ancestors (nearest parent first) and using the restrictions of the nearest restricted ancestor before falling back to space permissions. Inherited restrictions are fetched per ancestor via the restriction/byOperation endpoint, since Confluence does not expose them inline (and expanding ancestor restrictions on content/search 404s the whole batch on unreadable drafts, per CONFCLOUD-77618). Unreadable ancestors are treated as having no inheritable restriction. Closes #4095 Co-authored-by: Cursor <cursoragent@cursor.com>
Shorten verbose docstrings/comments and dedupe unit-test setup with a shared helper and parametrization, without dropping coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
Intersect child and all ancestor read restrictions so effective ACL matches Confluence's both-must-satisfy model; fail closed on ambiguous fetches and only fall back to space when the whole chain is unrestricted. Co-authored-by: Cursor <cursoragent@cursor.com>
| continue | ||
|
|
||
| try: | ||
| restrictions = await self.confluence_client.fetch_content_restrictions( |
There was a problem hiding this comment.
Does this introduce another permission the auth must have? If it does, we should document it.
There was a problem hiding this comment.
According to their docs: https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-content-restrictions/
it doesn't require anything on top of what we already have. We're allowed to get the restrictions for the child as part of the content during the search https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-content/#api-wiki-rest-api-content-search-get, it's the same as getting restrictions for the parents https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-content-restrictions/#api-wiki-rest-api-content-id-restriction-byoperation-get, but we focus on restrictions alone. Which is the same level of permission.
The wording is a bit confusing in their API reference, but I think it is safe to say that we don't have to get another permission for that. No admin/write ones for sure.
💔 Failed to create backport PR(s)
Successful backport PRs will be merged automatically after passing CI. To backport manually run: |
) (#4297) (#4305) Backports the following commits to 8.19: - fix(confluence): index inherited page restrictions for DLS (#4095) (#4297) Manual backport: auto-cherry-pick failed due to conflicts from the monolithic → `atlassian/confluence/` package split. Same DLS behavior as #4297, applied to `connectors/sources/confluence.py` on 8.19. Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>
2 participants
Closes #4095
When a Confluence page has no page-level restrictions of its own but inherits view restrictions from ancestors — or has its own restrictions that must also satisfy parent restrictions — the connector previously either ignored inherited ACL or used only the nearest restricted ancestor / the child's list alone, then fell back to broad space-level permissions. That over-granted access in
_allow_access_control(a Document Level Security gap).Confluence's documented view model requires users to satisfy both parent and child view restrictions (CONF57). This change resolves the effective read ACL as the intersection of:
Behavior details:
rest/api/content/{id}/restriction/byOperation/read(Confluence does not expose inherited restrictions inline; expandingancestors.restrictions...oncontent/search404s the whole batch on unreadable drafts — CONFCLOUD-77618)._allow_access_control = []and do not fall back to space ACL (sync continues).Applies to Confluence Cloud, Server, and Data Center. Advanced Sync Rules /
search_by_queryACL is unchanged (out of scope).Checklists
Pre-Review Checklist
config.yml.example)v7.13.2,v7.14.0,v8.0.0)Changes Requiring Extra Attention
Related Pull Requests
Release Note
Confluence connector Document Level Security now indexes effective page view restrictions by intersecting the child's and all ancestors' explicit read restrictions, instead of falling back to broader space-level permissions when a child page has no restrictions of its own (or only its own list). Ambiguous ancestor restriction fetches fail closed without over-granting via space ACL.