trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-30 07:33:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): authorize provider environment access

Browse Source 
Require workspace authorization before returning sandbox provider environment or credential binding data, while preserving sandbox-principal scope checks and not-found concealment.

Signed-off-by: Akber Raza <akberr@nvidia.com>
This commit is contained in:
Akber Raza
2026-09-16 17:29:15 -07:00
committed by Drew Newberry
parent f6f6ed5836
commit f39b31407d
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-server/src/grpc/policy.rs
+19 -7
View File
@@ -3403,15 +3403,11 @@ pub(super) async fn handle_get_sandbox_provider_environment(
) -> Result<Response<GetSandboxProviderEnvironmentResponse>, Status> {
let sandbox_id = request.get_ref().sandbox_id.clone();
let supports_static_credential_bindings = request.get_ref().supports_static_credential_bindings;
crate::auth::guard::enforce_sandbox_scope(&request, &sandbox_id)?;
let principal = crate::auth::guard::enforce_sandbox_scope(&request, &sandbox_id)?;
drop(request);
let sandbox = state
.store
.get_message::<Sandbox>(&sandbox_id)
.await
.map_err(|e| Status::internal(format!("fetch sandbox failed: {e}")))?
.ok_or_else(|| Status::not_found("sandbox not found"))?;
let sandbox =
super::sandbox::fetch_and_authorize_sandbox(state, &principal, &sandbox_id).await?;
let workspace = sandbox.object_workspace().to_string();
let spec = sandbox
@@ -21593,6 +21589,22 @@ mod tests {
"handle_get_sandbox_config must return NotFound, not PermissionDenied"
);
// --- handle_get_sandbox_provider_environment ---
let err = handle_get_sandbox_provider_environment(
&state,
non_member_request(GetSandboxProviderEnvironmentRequest {
sandbox_id: "sandbox-other".into(),
supports_static_credential_bindings: true,
}),
)
.await
.unwrap_err();
assert_eq!(
err.code(),
Code::NotFound,
"handle_get_sandbox_provider_environment must hide cross-workspace sandboxes"
);
// --- handle_get_sandbox_logs ---
let err = handle_get_sandbox_logs(
&state,