Skip to content

Additional hardening for queue access controls #1152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cassidyjames wants to merge 12 commits into from
Closed

Additional hardening for queue access controls #1152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
7e3ac76
Fix broken access control on MRT queue/job read & dequeue
serendipty01 Jul 23, 2026
43d5073
Authorize queue-scoped MRT fields instead of only authenticating
cassidyjames Sep 9, 2026
fb36e94
CHANGELOG: note the queue and job access control fix
cassidyjames Sep 9, 2026
1972a3f
MRT: scope getExistingJobsForItem to the caller's reviewable queues
cassidyjames Sep 9, 2026
7da7865
MRT: authorize the remaining queue-scoped ManualReviewQueue fields
cassidyjames Sep 9, 2026
61ef824
chore: update QueueOperations.test comment for clarity
cassidyjames Sep 10, 2026
d63717d
docs: update CHANGELOG
cassidyjames Sep 10, 2026
cbba8df
Update CHANGELOG.md
cassidyjames Sep 10, 2026
10f7fb3
createMrtQueue: allow a custom queue name
cassidyjames Sep 10, 2026
9a2eeb1
MRT: return no existing jobs for a caller with no reviewable queues
cassidyjames Sep 10, 2026
a09a911
MRT: reuse the per-request queue lookup in getExistingJobsForItem
cassidyjames Sep 10, 2026
b4755b4
docs: close parenthesis in CHANGELOG
cassidyjames Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ For more information about each release including git tags and artifacts, see [R
- Scylla healthcheck probing gossip instead of CQL readiness ([#1041](https://github.com/roostorg/coop/pull/1041) by [@reitblatt](https://github.com/reitblatt))
- Podman Compose setup failing to resolve the backend ([#981](https://github.com/roostorg/coop/pull/981) by [@juanmrad](https://github.com/juanmrad))
- DB Migrator rejecting non-standard Scylla ports ([#878](https://github.com/roostorg/coop/pull/878) by [@jess-upscrolled](https://github.com/jess-upscrolled))
- Review queue and job access control hardening ([#1151](https://github.com/roostorg/coop/pull/1151) by [@serendipty01](https://github.com/serendipty01) and [@cassidyjames](https://github.com/cassidyjames))

### Security

Expand Down
Loading
Loading