From 8a4e07fa82aab08423e5ef0c4e2a62f9e3d805e4 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Fri, 2 Oct 2026 18:32:14 +0200 Subject: [PATCH] fix: exclude restricted runnables from dedicated worker startup Co-Authored-By: Claude Opus 5.5 (1M context) --- backend/ee-repo-ref.txt | 2 +- backend/tests/job_token_scopes.rs | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt index 38d164ba09..6759927970 100644 --- a/backend/ee-repo-ref.txt +++ b/backend/ee-repo-ref.txt @@ -1 +1 @@ -d5879586211e7116d8198f9a03a0fcbb81c55787 \ No newline at end of file +56f2d36eff7edc4a2e36e89d8e3cb17588ceef38 \ No newline at end of file diff --git a/backend/tests/job_token_scopes.rs b/backend/tests/job_token_scopes.rs index 13838400a8..e9ecca5de5 100644 --- a/backend/tests/job_token_scopes.rs +++ b/backend/tests/job_token_scopes.rs @@ -127,6 +127,16 @@ async fn test_restricted_job_token_is_confined(db: Pool) -> anyhow::Re .await?; assert_eq!(resp.status() == StatusCode::FORBIDDEN, refused, "{job}"); } + // Its progress reaches only the flow it runs in. + for (flow, refused) in [(FLOW_JOB, false), (RUN_JOB, true)] { + let resp = client + .post(format!("{base}/job_metrics/set_progress/{OIDC_JOB}")) + .bearer_auth(&oidc_token) + .json(&json!({ "percent": 50, "flow_job_id": flow })) + .send() + .await?; + assert_eq!(resp.status() == StatusCode::FORBIDDEN, refused, "{flow}"); + } // A job it starts is capped at its own scopes, intersected with the target's setting. let run_token = job_token(&db, RUN_JOB).await?;