Files
Ruben Fiszel e1e7af6a25 fix: prevent token label collision bypassing job read access control (#9462)
* fix: prevent token label collision bypassing job read access control

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: regression tests for token label collision job read access

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: bind job-read override fast-path to permissioned_as_email

Replaces the reserved-label / label-* exclusion approach: webhook-/http-/email-
labels are created through the public token API by the trigger panels, so they
cannot be reserved, and blocking label-* regressed legitimate re-reads. Instead
the username_override fast-path now requires the job's permissioned_as_email
(non-forgeable, never derived from the label) to equal the caller's email.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-06 07:47:52 +00:00
..