hazza/jupyterhub
1
0
Fork 0
mirror of https://github.com/jupyterhub/jupyterhub.git synced 2025-10-12 20:43:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

esnure activity permissions are present in server tokens

Browse Source 
with a warning

avoids case where custom server token permissions remove necessary permissions for posting activity updates
This commit is contained in:
Min RK
2023-03-23 10:43:54 +01:00
parent 83186e02a2
commit 7383c0cf60
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
jupyterhub/tests/test_spawner.py
View File

@@ -374,13 +374,13 @@ async def test_spawner_bad_api_token(app):
(["self"], [], ["access:servers!server=USER/", "users:activity!user"]), (["self"], [], ["access:servers!server=USER/", "users:activity!user"]),
( (
["self"], ["self"],
["admin:groups", "users:activity!server"], ["admin:groups", "read:servers!server"],
["users:activity!server=USER/"], ["users:activity!user", "read:servers!server=USER/"],
), ),
( (
["self", "read:groups!group=x"], ["self", "read:groups!group=x", "users:activity"],
["admin:groups", "users:activity!user"], ["admin:groups", "users:activity"],
["read:groups!group=x", "read:groups:name!group=x", "users:activity!user"], ["read:groups!group=x", "read:groups:name!group=x", "users:activity"],
), ),
], ],
) )

10
jupyterhub/user.py
View File

@@ -693,6 +693,16 @@ class User:
scope + server_filter if scope.endswith("!server") else scope scope + server_filter if scope.endswith("!server") else scope
for scope in requested_scopes for scope in requested_scopes
} }
# ensure activity scope is requested, since activity doesn't work without
activity_scope = "users:activity!user"
if not {activity_scope, "users:activity", "inherit"}.intersection(
requested_scopes
):
self.log.warning(
f"Adding required scope {activity_scope} to server token, missing from Spawner.server_token_scopes. Please make sure to add it!"
)
requested_scopes |= {activity_scope}
have_scopes = roles.roles_to_scopes(roles.get_roles_for(self.orm_user)) have_scopes = roles.roles_to_scopes(roles.get_roles_for(self.orm_user))
have_scopes |= {"inherit"} have_scopes |= {"inherit"}
jupyterhub_client = ( jupyterhub_client = (