372cf33cae
* refactor(auth): remove the vestigial per-author script permission plumbing #7975 is closed won't-do: authoring a workflow is a trusted act, and a per-author gate would not change what a script can do once it runs. The host switch stays the control, and it is per language, so an untrusted author gets a host with the switch off rather than a permission. That settles what the code was still half-carrying. WorkflowDefinitionScriptAuthorizationService took a ClaimsPrincipal it never read, and could return a MissingPermission reason nothing produced; two call sites branched on that reason to send a 403 that could not happen. The expression-descriptor endpoint kept a map from expression type to per-author permission whose values went unused even before the permissions were retired -- it only ever tested membership, and the decision was always IsBrowsable. Each of these reads as an authorization gate to anyone scanning the file, and none of them is one. The principal, the unreachable reason, and both dead branches are gone. The map becomes a set of the expression types the host can switch off, which is what it was actually being used as. Behaviour is unchanged: the only failure is a language the host disabled, which is a property of the deployment and so a 400 naming the switch, never a 403. PermissionNames loses ExecuteCSharpExpressions and ExecutePythonExpressions, which existed only for that map and the test mirroring it. Five other legacy constants there are also unreferenced but belong to other modules; they are left alone rather than swept up here. Two tests asserting the host-and-user case were exact duplicates of the host-only case once the principal stopped mattering, so they go with it. The migration guide said deployments lose per-author granularity "until #7975 lands" and advised disabling host code until then. That promise is withdrawn and replaced with the actual guidance. Closes #7975 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(wiki): drop the retired exec:* permissions from the scripting guide Review found doc/wiki/expressions-and-scripting.md still telling operators that API callers "must have the exec:csharp-expressions permission" to author, publish, dispatch or execute workflows containing C#, and the same for Python. Those permissions no longer exist, so the instruction cannot be followed and describes a gate that is not there. Both sections now say what is actually true: the host switch is the whole control, there is no per-caller permission because a workflow runs under the server's authority rather than the caller's, and an untrusted author gets a host with the switch off. The switches are noted as independent, since enabling Python while leaving C# off is a real posture. My earlier sweep searched for the issue number rather than the permission strings, which is why this file was missed. Refs #7975 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
34 lines
1.1 KiB
C#
34 lines
1.1 KiB
C#
namespace Elsa;
|
|
|
|
public static class PermissionNames
|
|
{
|
|
public const string All = "*";
|
|
public const string ClaimType = "permissions";
|
|
|
|
|
|
/// <summary>
|
|
/// Permission required to pause, resume, or force-drain the workflow runtime.
|
|
/// </summary>
|
|
public const string ManageWorkflowRuntime = "ManageWorkflowRuntime";
|
|
|
|
/// <summary>
|
|
/// Permission required to query workflow runtime status.
|
|
/// </summary>
|
|
public const string ReadWorkflowRuntime = "read:workflow-runtime";
|
|
|
|
/// <summary>
|
|
/// Permission required to list or inspect bookmark queue dead-letter items.
|
|
/// </summary>
|
|
public const string ReadBookmarkQueueDeadLetters = "read:bookmark-queue:dead-letters";
|
|
|
|
/// <summary>
|
|
/// Permission required to replay bookmark queue dead-letter items.
|
|
/// </summary>
|
|
public const string ReplayBookmarkQueueDeadLetters = "replay:bookmark-queue:dead-letters";
|
|
|
|
/// <summary>
|
|
/// Permission required to delete bookmark queue dead-letter items.
|
|
/// </summary>
|
|
public const string DeleteBookmarkQueueDeadLetters = "delete:bookmark-queue:dead-letters";
|
|
}
|