Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[24.0] Fix authentication error for anonymous users querying jobs #18333

Merged
merged 3 commits into from
Jun 7, 2024
Merged

[24.0] Fix authentication error for anonymous users querying jobs #18333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2e91272
Fix error for anonymous user listing jobs
davelopez Jun 6, 2024
497ca2f
Fix mypy: now it catches this error thanks to the ProvidesUserContext…
davelopez Jun 6, 2024
7caee0b
Import from typing in preparation for more type annotations
davelopez Jun 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions lib/galaxy/managers/jobs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
import json
import logging
import typing
from datetime import (
date,
datetime,
)
from typing import (
Dict,
Optional,
)

import sqlalchemy
from boltons.iterutils import remap
Expand Down Expand Up @@ -37,6 +40,7 @@
Safety,
)
from galaxy.managers.collections import DatasetCollectionManager
from galaxy.managers.context import ProvidesUserContext
from galaxy.managers.datasets import DatasetManager
from galaxy.managers.hdas import HDAManager
from galaxy.managers.lddas import LDDAManager
Expand Down Expand Up @@ -105,7 +109,9 @@ def __init__(self, app: StructuredApp):
self.app = app
self.dataset_manager = DatasetManager(app)

def index_query(self, trans, payload: JobIndexQueryPayload) -> sqlalchemy.engine.Result:
def index_query(
self, trans: ProvidesUserContext, payload: JobIndexQueryPayload
) -> Optional[sqlalchemy.engine.Result]:
"""The caller is responsible for security checks on the resulting job if
history_id, invocation_id, or implicit_collection_jobs_id is set.
Otherwise this will only return the user's jobs or all jobs if the requesting
Expand All @@ -121,6 +127,13 @@ def index_query(self, trans, payload: JobIndexQueryPayload) -> sqlalchemy.engine
search = payload.search
order_by = payload.order_by

if trans.user is None:
# If the user is anonymous we can only return jobs for the current session history
if trans.galaxy_session and trans.galaxy_session.current_history_id:
history_id = trans.galaxy_session.current_history_id
else:
return None
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wondering if we should raise an AuthenticationRequired exception here instead, so the error is not hidden from the user.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not an error, if a session doesn't have a history it also doesn't have any jobs.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But None is returned also is trans.galaxy_session is None.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which is fine and not a error ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could as well query some public thing, like jobs belonging to a history, raising an exception here feels very unpredictable.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then I don't understand the changes in lines 131-133 above: if we want a session-less user to be able to view public history jobs, we should overwrite history_id only when it's None .

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is a good point, we might want to instead filter on the job itself using the session id.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If history_id is passed in the API payload, the job's history accessibility is checked on the jobs returned by this method at

galaxy/lib/galaxy/webapps/galaxy/services/jobs.py

Line 89 in 7caee0b

if check_security_of_jobs and not security_check(trans, job.history, check_accessible=True):

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the catch! I'll follow up with the proposed change 👍


def build_and_apply_filters(stmt, objects, filter_func):
if objects is not None:
if isinstance(objects, (str, date, datetime)):
Expand Down Expand Up @@ -207,7 +220,7 @@ def add_search_criteria(stmt):
if user_details:
stmt = stmt.outerjoin(Job.user)
else:
if history_id is None and invocation_id is None and implicit_collection_jobs_id is None:
if history_id is None and invocation_id is None and implicit_collection_jobs_id is None and trans.user:
stmt = stmt.where(Job.user_id == trans.user.id)
# caller better check security

Expand Down Expand Up @@ -630,7 +643,7 @@ def replace_dataset_ids(path, key, value):
return None


def view_show_job(trans, job: Job, full: bool) -> typing.Dict:
def view_show_job(trans, job: Job, full: bool) -> Dict:
is_admin = trans.user_is_admin
job_dict = job.to_dict("element", system_details=is_admin)
if trans.app.config.expose_dataset_path and "command_line" not in job_dict:
Expand Down
4 changes: 3 additions & 1 deletion lib/galaxy/webapps/galaxy/services/jobs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,9 @@ def index(
or payload.history_id is not None
)
jobs = self.job_manager.index_query(trans, payload)
out = []
out: List[Dict[str, Any]] = []
if jobs is None:
return out
for job in jobs.yield_per(model.YIELD_PER_ROWS):
# TODO: optimize if this crucial
if check_security_of_jobs and not security_check(trans, job.history, check_accessible=True):
Expand Down
Loading