From 23bef7f31f4eeb722b58500ff855eb0bd3422573 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Wed, 7 Feb 2024 22:45:07 +0100 Subject: [PATCH] fix: improve agent policies --- ...cept_missing_config_in_policies_2.down.sql | 1 + ...accept_missing_config_in_policies_2.up.sql | 44 +++++++++++++++++++ backend/windmill-api/src/scripts.rs | 2 + 3 files changed, 47 insertions(+) create mode 100644 backend/migrations/20240207211936_accept_missing_config_in_policies_2.down.sql create mode 100644 backend/migrations/20240207211936_accept_missing_config_in_policies_2.up.sql diff --git a/backend/migrations/20240207211936_accept_missing_config_in_policies_2.down.sql b/backend/migrations/20240207211936_accept_missing_config_in_policies_2.down.sql new file mode 100644 index 0000000000..d2f607c5b8 --- /dev/null +++ b/backend/migrations/20240207211936_accept_missing_config_in_policies_2.down.sql @@ -0,0 +1 @@ +-- Add down migration script here diff --git a/backend/migrations/20240207211936_accept_missing_config_in_policies_2.up.sql b/backend/migrations/20240207211936_accept_missing_config_in_policies_2.up.sql new file mode 100644 index 0000000000..fd3271a4d2 --- /dev/null +++ b/backend/migrations/20240207211936_accept_missing_config_in_policies_2.up.sql @@ -0,0 +1,44 @@ +-- Add up migration script here +DROP POLICY see_own_path ON queue; +DROP POLICY see_member_path ON queue; +DROP POLICY see_own ON queue; +DROP POLICY see_member ON queue; +DROP POLICY see_folder_extra_perms_user ON queue; +DROP POLICY see_own_path ON completed_job; +DROP POLICY see_member_path ON completed_job; +DROP POLICY see_own ON completed_job; +DROP POLICY see_member ON completed_job; +DROP POLICY see_folder_extra_perms_user ON completed_job; + + +CREATE POLICY see_own_path ON queue FOR ALL +USING (queue.visible_to_owner IS true AND SPLIT_PART(queue.script_path, '/', 1) = 'u' AND SPLIT_PART(queue.script_path, '/', 2) = current_setting('session.user', true)); + +CREATE POLICY see_member_path ON queue FOR ALL +USING (queue.visible_to_owner IS true AND SPLIT_PART(queue.script_path, '/', 1) = 'g' AND SPLIT_PART(queue.script_path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[])); + +CREATE POLICY see_own ON queue FOR ALL +USING (SPLIT_PART(queue.permissioned_as, '/', 1) = 'u' AND SPLIT_PART(queue.permissioned_as, '/', 2) = current_setting('session.user', true)); + +CREATE POLICY see_member ON queue FOR ALL +USING (SPLIT_PART(queue.permissioned_as, '/', 1) = 'g' AND SPLIT_PART(queue.permissioned_as, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[])); + +CREATE POLICY see_folder_extra_perms_user ON queue FOR ALL + USING (((visible_to_owner IS TRUE) AND (split_part((script_path)::text, '/'::text, 1) = 'f'::text) AND (split_part((script_path)::text, '/'::text, 2) = ANY (regexp_split_to_array(current_setting('session.folders_read'::text, true), ','::text))))); + + + +CREATE POLICY see_own_path ON completed_job FOR ALL +USING (completed_job.visible_to_owner IS true AND SPLIT_PART(completed_job.script_path, '/', 1) = 'u' AND SPLIT_PART(completed_job.script_path, '/', 2) = current_setting('session.user', true)); + +CREATE POLICY see_member_path ON completed_job FOR ALL +USING (completed_job.visible_to_owner IS true AND SPLIT_PART(completed_job.script_path, '/', 1) = 'g' AND SPLIT_PART(completed_job.script_path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[])); + +CREATE POLICY see_own ON completed_job FOR ALL +USING (SPLIT_PART(completed_job.permissioned_as, '/', 1) = 'u' AND SPLIT_PART(completed_job.permissioned_as, '/', 2) = current_setting('session.user', true)); + +CREATE POLICY see_member ON completed_job FOR ALL +USING (SPLIT_PART(completed_job.permissioned_as, '/', 1) = 'g' AND SPLIT_PART(completed_job.permissioned_as, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[])); + +CREATE POLICY see_folder_extra_perms_user ON completed_job FOR ALL + USING (((visible_to_owner IS TRUE) AND (split_part((script_path)::text, '/'::text, 1) = 'f'::text) AND (split_part((script_path)::text, '/'::text, 2) = ANY (regexp_split_to_array(current_setting('session.folders_read'::text, true), ','::text))))); \ No newline at end of file diff --git a/backend/windmill-api/src/scripts.rs b/backend/windmill-api/src/scripts.rs index 686a66ce5f..2ec225307a 100644 --- a/backend/windmill-api/src/scripts.rs +++ b/backend/windmill-api/src/scripts.rs @@ -610,6 +610,8 @@ async fn create_script( if needs_lock_gen { let tag = if ns.dedicated_worker.is_some_and(|x| x) { Some(format!("{}:{}", &w_id, &ns.path,)) + } else if ns.tag.as_ref().is_some_and(|x| x.contains("$args[")) { + None } else { ns.tag };