fix(api): getWorkflowJobQueueHandler filter by group for all hatcheri…

…es (#5079) Signed-off-by: francois samin <[email protected]>
ovh · Mar 25, 2020 · 8a6f308 · 8a6f308
1 parent 4feb0fe
commit 8a6f308
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/engine/api/workflow_queue.go b/engine/api/workflow_queue.go
@@ -741,12 +741,12 @@ func (api *API) getWorkflowJobQueueHandler() service.Handler {
 			return errM
 		}
 
-		permissions := sdk.PermissionReadExecute
+		permissions := sdk.PermissionRead
 
 		isW := isWorker(ctx)
 		isS := isService(ctx)
-		if !isW && !isS {
-			permissions = sdk.PermissionRead
+		if isW || isS {
+			permissions = sdk.PermissionReadExecute
 		}
 
 		filter := workflow.NewQueueFilter()
@@ -759,8 +759,10 @@ func (api *API) getWorkflowJobQueueHandler() service.Handler {
 		if modelType != "" {
 			filter.ModelType = []string{modelType}
 		}
+
 		var jobs []sdk.WorkflowNodeJobRun
-		if !isMaintainer(ctx) && !isAdmin(ctx) {
+		// If the consumer is a worker, a hatchery or a non maintainer user, filter the job by its groups
+		if isW || isS || !isMaintainer(ctx) {
 			jobs, err = workflow.LoadNodeJobRunQueueByGroupIDs(ctx, api.mustDB(), api.Cache, filter, getAPIConsumer(ctx).GetGroupIDs())
 		} else {
 			jobs, err = workflow.LoadNodeJobRunQueue(ctx, api.mustDB(), api.Cache, filter)