Bring WFJT job access to parity with UnifiedJobAccess #15344
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SUMMARY
Quick rundown in code - the method
WorkflowJobAccess.filtered_queryset
should always yield the same result asUnifiedJobAccess.filtered_queryset
. The same should be true for all other "unified" job types generally, since this is a polymorphic model.Quick rundown of net effect - if you visit
/api/v2/workflow_jobs/:id/
, that will use the concrete model (workflow job) rules, and this should not give a different "answer" than the listing at/api/v2/unified_jobs/
.The particular issue that we were seeing was that a user unexpectedly didn't have permission to view a workflow job. As I expected, when I wrote the test for this I found that it was essentially a solved problem... if the object was treated as a
UnifiedJob
as opposed to aWorkflowJob
.This makes it very hard to argue against a change. A courtroom judge need not be impartial, but must be consistent in their rulings if they are to maintain the rule of law.
This is written to allow a backport with the changes:
UnifiedJob.filtered_queryset
should revert to no changesWorkflowJobAccess.filtered_queryset
must revert to use theauditor_qs
due to the lack of admin->auditor inheritanceAAP-20831
ISSUE TYPE
COMPONENT NAME