[Artifacts] Verify artifact permissions when listing artifact tags (#…

…5684)
mlrun · Jun 2, 2024 · aff5943 · aff5943
1 parent 99cfe61
commit aff5943
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/server/api/api/endpoints/artifacts.py b/server/api/api/endpoints/artifacts.py
@@ -97,6 +97,15 @@ async def list_artifact_tags(
         mlrun.common.schemas.AuthorizationAction.read,
         auth_info,
     )
+    # verify that the user has permissions to read the project's artifacts
+    await server.api.utils.auth.verifier.AuthVerifier().query_project_resource_permissions(
+        mlrun.common.schemas.AuthorizationResourceTypes.artifact,
+        project,
+        "",
+        mlrun.common.schemas.AuthorizationAction.read,
+        auth_info,
+    )
+
     tags = await run_in_threadpool(
         server.api.crud.Artifacts().list_artifact_tags, db_session, project, category
     )