Ruben Fiszel 2d24b3ac49 fix(jobs): enforce self_approval_disabled on the UI resume path (#10262) ...

* fix(jobs): enforce self_approval_disabled on the UI resume path

The "Resume" button in the run detail UI calls the resume_suspended endpoint,
whose owner shortcut skipped the approval-condition checks entirely. A flow
owner/operator who triggered the run could therefore self-approve despite
self_approval_disabled, unlike the owner endpoint which enforces it. Only
admins should bypass self-approval.

- Extract require_not_self_approval and enforce it before the owner shortcut in
  resume_suspended and can_approve_step (button visibility), matching
  resume_suspended_flow_as_owner.
- Persist approval_conditions when self_approval_disabled is set even without
  user_auth_required, so the restriction is not silently dropped at the resume
  boundary for raw-flow/CLI authors.

Fixes WIN-2223

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(jobs): keep self-approval capability-based on the secret path; docs/tests

Scope the self_approval_disabled enforcement to identity-based resume boundaries
only. Possession of the full HMAC resume URL is the authorization on the secret
path (the URL is disclosed only to intended approvers, e.g. when a step returns
it), so resume_suspended_job intentionally keeps skipping approval conditions and
token-only (anonymous) resumes on resume_suspended are not gated either. The
logged-in owner/operator self-approval fix stays.

- Add extract_approval_conditions helper (WAC vs classic) reused in resume_suspended.
- Update can_approve_step doc to reflect that self_approval_disabled bars the
  triggerer before the owner shortcut (codex nit).
- Reword new test comments to state the invariant, not prior behavior (codex nit).
- Add test_self_approval_disabled_without_user_auth_required covering the
  persistence + authenticated self-approval check for a non-owner triggerer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-22 16:52:46 +02:00

..

fixtures

feat(apps): opt-in sandbox isolation for published & raw apps (alpha) (#9420)

2026-06-23 10:05:00 +02:00

scripts

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

agent_workers.rs

fix: keep agent-worker server job-completed processor alive & self-healing (#10033)

2026-07-10 23:42:30 +02:00

app_anonymous_execution_mode.rs

fix(apps): invalidate cached app policy on change or deletion (GHSA-r5v4-cxh9-7qhq) (#10121)

2026-07-15 17:41:54 +02:00

app_custom_path_cross_workspace.rs

fix: actionable error when a custom_path is taken by an app in another workspace (#9190)

2026-05-16 08:29:53 +00:00

app_preview_auth.rs

require pinned sha for inline raw_code in viewer app run mode (#9570)

2026-06-14 23:48:03 +02:00

app_s3_onbehalf.rs

fix(apps): let entitled viewers read pre-existing S3 files from deployed apps (#10245)

2026-07-21 17:04:01 +00:00

asset_trigger_dispatch.rs

feat(pipelines): record upstream snapshot ids on cascade-dispatched jobs (#9910)

2026-07-04 00:10:18 +02:00

batch_rerun.rs

[ee] feat(backend): native script retry without one-step-flow wrapping (#9688)

2026-06-25 13:22:26 +00:00

bun_jobs.rs

fix: invalidate bun bundle cache on transitive relative-import changes (#9891)

2026-07-02 23:57:26 +02:00

ci_tests.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

debounce_e2e.rs

fix(debounce): never supersede a running debounce survivor (#9780)

2026-06-25 16:36:16 +00:00

dedicated_workers.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

delete_after_secs.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

dependency_map.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

drafts_nul.rs

fix(backend): strip NUL bytes from draft values on write (#9673)

2026-06-19 13:33:36 +00:00

end_user_email.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

error_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

flow_engine_parity.rs

feat(flows): opt-in to include the stopping step's result in early-stop errors (#9446)

2026-06-04 18:57:05 +00:00

folder_default_permissioned_as.rs

feat: folder default_permissioned_as rules for ownership defaults on deploy (#8801)

2026-04-12 20:14:07 +00:00

fork_deployment_requests.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

freshness_watchdog.rs

feat(pipelines): asset freshness — fresh/stale badge (CE) + watchdog (EE) (#9909)

2026-07-04 06:23:44 +02:00

inline_preview_auth.rs

block operators from inline preview job execution (#9572)

2026-06-15 00:07:46 +02:00

instance_config.rs

fix: treat empty global setting strings as unset (#8793)

2026-04-10 14:23:37 +00:00

job_payload.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

jobs_read_auth.rs

feat(api): add structured endpoint for flow logs (#9797)

2026-06-25 16:50:40 +00:00

list_jobs.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

mcp_resource_authz.rs

fix(ai): enforce resource authz when loading MCP tools in agent worker (#9571)

2026-06-14 23:50:18 +02:00

mcp_token_exfil.rs

fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428)

2026-06-03 09:00:43 +00:00

nativets_dedicated.rs

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

nativets_jobs.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

nativets_stress.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

operator_db_sync.rs

fix: add secretKeyRef support for jwt_secret and rsa_keys (#8698)

2026-04-03 18:17:27 +00:00

otel.rs

feat(otel): connect jobs to the inbound distributed trace (#9456)

2026-06-05 16:50:07 +00:00

postgres_trigger_scope.rs

fix(postgres-triggers): enforce resource-path scopes on ancillary routes (#10222)

2026-07-21 09:21:07 +00:00

preserve_on_behalf_of.rs

feat: use derived username instead of email for non-member superadmins (#9857)

2026-07-01 14:54:07 +00:00

preview_native_tag.rs

fix(backend): route //native TypeScript previews to native workers (WIN-2007) (#9407)

2026-06-02 10:23:39 +00:00

protection_rules.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

python_jobs.rs

feat: Data Pipelines alpha (#9193)

2026-06-18 18:09:02 +02:00

relock_skip.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

restart_at_step_api.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

retry.rs

fix(flows): skip_if evaluates wrong previous_result during retry (#9547)

2026-06-12 17:31:31 +02:00

script_auto_kind_failure.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

script_auto_parent_archived.rs

fix: reset parent_hash in auto_parent when all versions at path are archived (#9172)

2026-05-16 07:43:35 +00:00

script_modules.rs

feat: Data Pipelines alpha (#9193)

2026-06-18 18:09:02 +02:00

script_rename_clears_assets.rs

fix: clear old path asset usage when renaming a script (#9979)

2026-07-07 14:23:31 +02:00

sign_s3_objects_authz.rs

fix: enforce read authorization when signing S3 objects (#10049)

2026-07-11 05:57:48 +02:00

success_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

suspend_resume.rs

fix(jobs): enforce self_approval_disabled on the UI resume path (#10262)

2026-07-22 16:52:46 +02:00

trigger_listener_queries.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

v2_job_delete_orphans.rs

perf: drop v2_job side-table ON DELETE CASCADE FKs to speed retention deletes (#9786)

2026-06-25 13:52:30 +00:00

volume_tests.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

wm_token_superadmin_guard.rs

fix: forbid superadmin job tokens from global user and token management (#9715)

2026-06-24 00:38:27 +02:00

worker.rs

feat(worker-tags): add * fork marker to workspace-scoped custom tags (#10177)

2026-07-17 18:18:54 +02:00

workspace_dependencies.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

workspace_export.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

workspace_fairness.rs

fix(queue): duration-weighted workspace fairness signal (#9329)

2026-05-26 11:47:45 +00:00

ws_specific.rs

fix(security): enforce variables:write scope on resource-delete var cascade (GHSA-xmr2-98m6-cjf7) (#10123)

2026-07-15 13:19:17 +02:00