[PR #1179] [CLOSED] fix: filter build update logs by user resource permissions #10480

New Issue

GiteaMirror · 2026-05-08T16:07:00-05:00

GiteaMirror commented

2026-05-08 16:07:00 -05:00

📋 Pull Request Information

Original PR: https://github.com/moghtech/komodo/pull/1179
Author: @litlmike
Created: 2/8/2026
Status: ❌ Closed

Base: main ← Head: fix-issue-1011

📝 Commits (1)

6fc412d fix: filter build update logs by user resource permissions

📊 Changes

1 file changed (+13 additions, -4 deletions)

View changed files

📝 bin/core/src/api/read/update.rs (+13 -4)

📄 Description

Problem

Non-admin users see Run Build update logs from other deployments in the Updates window (issue #1011).

Root Cause

In ListUpdates, when a non-admin user's query contains a $or filter (e.g., when viewing a deployment page that shows associated build updates), the permission filter's $or overwrites the user's $or via Document::extend(). This causes the user's resource-specific filter to be lost, showing all updates the user has permission on rather than the filtered subset.

For example, when viewing a deployment page:

Frontend sends { $or: [deployment_filter, build_filter] }
Backend calls query.extend(doc! { $or: [permission_filters] })
The permission $or replaces the user's $or
User sees all permitted updates instead of just that deployment's updates

Fix

Use $and to combine the user query with the permission filter, preserving both constraints:

The user's filter (which resource to show)
The permission filter (which resources the user can access)

Fixes #1011

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/moghtech/komodo/pull/1179 **Author:** [@litlmike](https://github.com/litlmike) **Created:** 2/8/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-issue-1011` --- ### 📝 Commits (1) - [`6fc412d`](https://github.com/moghtech/komodo/commit/6fc412d3ddfb0942008216a0ba5f1cb1dbba19cb) fix: filter build update logs by user resource permissions ### 📊 Changes **1 file changed** (+13 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `bin/core/src/api/read/update.rs` (+13 -4) </details> ### 📄 Description ## Problem Non-admin users see Run Build update logs from other deployments in the Updates window (issue #1011). ## Root Cause In `ListUpdates`, when a non-admin user's query contains a `$or` filter (e.g., when viewing a deployment page that shows associated build updates), the permission filter's `$or` overwrites the user's `$or` via `Document::extend()`. This causes the user's resource-specific filter to be lost, showing all updates the user has permission on rather than the filtered subset. For example, when viewing a deployment page: 1. Frontend sends `{ $or: [deployment_filter, build_filter] }` 2. Backend calls `query.extend(doc! { $or: [permission_filters] })` 3. The permission `$or` **replaces** the user's `$or` 4. User sees all permitted updates instead of just that deployment's updates ## Fix Use `$and` to combine the user query with the permission filter, preserving both constraints: - The user's filter (which resource to show) - The permission filter (which resources the user can access) Fixes #1011 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-08 16:07:00 -05:00

GiteaMirror closed this issue

2026-05-08 16:07:01 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/komodo#10480