Skip to content

UN-2651 [FIX] Show execution logs to group and org-shared users - #2234

Draft
kirtimanmishrazipstack wants to merge 1 commit into
mainfrom
UN-2651-shared-project-logs
Draft

UN-2651 [FIX] Show execution logs to group and org-shared users#2234
kirtimanmishrazipstack wants to merge 1 commit into
mainfrom
UN-2651-shared-project-logs

Conversation

@kirtimanmishrazipstack

@kirtimanmishrazipstack kirtimanmishrazipstack commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

  • Teammates who receive a deployment or pipeline through a group share, or through an org-wide share, can now see its runs on the Logs page. Until now that page came back empty for them.
  • Execution logs can now only be opened by people the deployment or pipeline was actually shared with.

Why

  • A shared deployment that shows no runs reads as broken, and it failed exactly the people sharing was meant to help. Direct shares and co-owners already worked; group and org-wide shares were missed.
  • Log contents were reachable by anyone in the organisation who had a run's id, whether or not anything had been shared with them.

How

  • Executions resolve visibility through each resource's own for_user, which covers owner, co-owner, direct share, group share and shared_to_org.
  • /executions/<id>/logs/ and /logs/export/ gate on the executions the caller can see; an unknown id is denied the same way as an inaccessible one, so responses do not reveal which ids exist.
  • Dropped IsOwner from the log viewset — it implements only has_object_permission, which DRF never calls on list/export.

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

  • Only the logs endpoint narrows: a user who could previously fetch any execution's logs by id now needs access to that execution. No UI path exposed those ids, so normal flows are unaffected. The other change only widens visibility.

Database Migrations

  • None

Env Config

  • None

Relevant Docs

Related Issues or PRs

Dependencies Versions

  • None

Notes on Testing

  • backend/workflow_manager/execution/tests/test_shared_execution_access.py — 5 tests covering group share, org-wide share, unshared, and both log-access paths. 3 fail on main, all 5 pass on this branch.

Screenshots

Checklist

I have read and understood the Contribution Guidelines.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b198f37-a5c6-48f1-a6a1-af797332df21

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@kirtimanmishrazipstack @claude
UN-2651 [FIX] Show execution logs to group-shared and org-shared users
5faa618 
The executions list resolved visibility through direct memberships only,
so a deployment reached via a group share or shared_to_org opened fine
while its Logs page came back empty. Defer to each resource's own
for_user, which spans every sharing path the resource list itself honours
(owner, co-owner, direct share, group share, shared_to_org).

The per-execution logs and export endpoints had the mirrored problem: no
scoping at all. IsOwner sat in permission_classes but implements only
has_object_permission, which DRF never invokes on list/export, so any org
member holding an execution id could read and CSV-export its logs. Gate
the queryset on the executions the caller can see instead, and deny a
missing execution the same way as an inaccessible one so the response
does not confirm which ids exist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@kirtimanmishrazipstack
kirtimanmishrazipstack force-pushed the UN-2651-shared-project-logs branch from f680ac4 to 5faa618 Compare August 7, 2026 17:54
@sonarqubecloud

sonarqubecloud Bot commented Aug 7, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@kirtimanmishrazipstack kirtimanmishrazipstack changed the title UN-2651 [FIX] Show execution logs to group-shared and org-shared users UN-2651 [FIX] Show execution logs to group and org-shared users Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kirtimanmishrazipstack